diff --git a/aclocal.m4 b/aclocal.m4
index dd1b8658c..2fedf028c 100644
--- a/aclocal.m4
+++ b/aclocal.m4
@@ -736,7 +736,6 @@ _LT_CONFIG_SAVE_COMMANDS([
     cat <<_LT_EOF >> "$cfgfile"
 #! $SHELL
 # Generated automatically by $as_me ($PACKAGE) $VERSION
-# Libtool was configured on host `(hostname || uname -n) 2>/dev/null | sed 1q`:
 # NOTE: Changes made to this file will be lost: look at ltmain.sh.
 
 # Provide generalized library-building support services.
@@ -1048,8 +1047,8 @@ int forced_loaded() { return 2;}
 _LT_EOF
       echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&AS_MESSAGE_LOG_FD
       $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&AS_MESSAGE_LOG_FD
-      echo "$AR cru libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
-      $AR cru libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
+      echo "$AR cr libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
+      $AR cr libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
       echo "$RANLIB libconftest.a" >&AS_MESSAGE_LOG_FD
       $RANLIB libconftest.a 2>&AS_MESSAGE_LOG_FD
       cat > conftest.c << _LT_EOF
@@ -1499,7 +1498,7 @@ need_locks=$enable_libtool_lock
 m4_defun([_LT_PROG_AR],
 [AC_CHECK_TOOLS(AR, [ar], false)
 : ${AR=ar}
-: ${AR_FLAGS=cru}
+: ${AR_FLAGS=cr}
 _LT_DECL([], [AR], [1], [The archiver])
 _LT_DECL([], [AR_FLAGS], [1], [Flags to create an archive])
 
@@ -2873,9 +2872,6 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   # before this can be enabled.
   hardcode_into_libs=yes
 
-  # Add ABI-specific directories to the system library path.
-  sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /lib /usr/lib"
-
   # Ideally, we could use ldconfig to report *all* directores which are
   # searched for libraries, however this is still not possible.  Aside from not
   # being certain /sbin/ldconfig is available, command
@@ -2884,7 +2880,7 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   # appending ld.so.conf contents (and includes) to the search path.
   if test -f /etc/ld.so.conf; then
     lt_ld_extra=`awk '/^include / { system(sprintf("cd /etc; cat %s 2>/dev/null", \[$]2)); skip = 1; } { if (!skip) print \[$]0; skip = 0; }' < /etc/ld.so.conf | $SED -e 's/#.*//;/^[	 ]*hwcap[	 ]/d;s/[:,	]/ /g;s/=[^=]*$//;s/=[^= ]* / /g;s/"//g;/^$/d' | tr '\n' ' '`
-    sys_lib_dlsearch_path_spec="$sys_lib_dlsearch_path_spec $lt_ld_extra"
+    sys_lib_dlsearch_path_spec="/lib /usr/lib $lt_ld_extra"
   fi
 
   # We used to test for /lib/ld.so.1 and disable shared libraries on
@@ -2896,6 +2892,18 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   dynamic_linker='GNU/Linux ld.so'
   ;;
 
+netbsdelf*-gnu)
+  version_type=linux
+  need_lib_prefix=no
+  need_version=no
+  library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major ${libname}${shared_ext}'
+  soname_spec='${libname}${release}${shared_ext}$major'
+  shlibpath_var=LD_LIBRARY_PATH
+  shlibpath_overrides_runpath=no
+  hardcode_into_libs=yes
+  dynamic_linker='NetBSD ld.elf_so'
+  ;;
+
 netbsd*)
   version_type=sunos
   need_lib_prefix=no
@@ -3555,7 +3563,7 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   lt_cv_deplibs_check_method=pass_all
   ;;
 
-netbsd*)
+netbsd* | netbsdelf*-gnu)
   if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then
     lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\.[[0-9]]+\.[[0-9]]+|_pic\.a)$'
   else
@@ -4061,7 +4069,8 @@ _LT_EOF
   if AC_TRY_EVAL(ac_compile); then
     # Now try to grab the symbols.
     nlist=conftest.nm
-    if AC_TRY_EVAL(NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist) && test -s "$nlist"; then
+    $ECHO "$as_me:$LINENO: $NM conftest.$ac_objext | $lt_cv_sys_global_symbol_pipe > $nlist" >&AS_MESSAGE_LOG_FD
+    if eval "$NM" conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist 2>&AS_MESSAGE_LOG_FD && test -s "$nlist"; then
       # Try sorting and uniquifying the output.
       if sort "$nlist" | uniq > "$nlist"T; then
 	mv -f "$nlist"T "$nlist"
@@ -4433,7 +4442,7 @@ m4_if([$1], [CXX], [
 	    ;;
 	esac
 	;;
-      netbsd*)
+      netbsd* | netbsdelf*-gnu)
 	;;
       *qnx* | *nto*)
         # QNX uses GNU C++, but need to define -shared option too, otherwise
@@ -4701,6 +4710,12 @@ m4_if([$1], [CXX], [
 	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
 	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
         ;;
+      # flang / f18. f95 an alias for gfortran or flang on Debian
+      flang* | f18* | f95*)
+	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
+	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
+	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
+        ;;
       # icc used to be incompatible with GCC.
       # ICC 10 doesn't accept -KPIC any more.
       icc* | ifort*)
@@ -4945,6 +4960,9 @@ m4_if([$1], [CXX], [
       ;;
     esac
     ;;
+  linux* | k*bsd*-gnu | gnu*)
+    _LT_TAGVAR(link_all_deplibs, $1)=no
+    ;;
   *)
     _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED '\''s/.* //'\'' | sort | uniq > $export_symbols'
     ;;
@@ -5007,6 +5025,9 @@ dnl Note also adjust exclude_expsyms for C++ above.
   openbsd* | bitrig*)
     with_gnu_ld=no
     ;;
+  linux* | k*bsd*-gnu | gnu*)
+    _LT_TAGVAR(link_all_deplibs, $1)=no
+    ;;
   esac
 
   _LT_TAGVAR(ld_shlibs, $1)=yes
@@ -5261,7 +5282,7 @@ _LT_EOF
       fi
       ;;
 
-    netbsd*)
+    netbsd* | netbsdelf*-gnu)
       if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	_LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib'
 	wlarc=
@@ -5782,6 +5803,7 @@ _LT_EOF
 	if test yes = "$lt_cv_irix_exported_symbol"; then
           _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations $wl-exports_file $wl$export_symbols -o $lib'
 	fi
+	_LT_TAGVAR(link_all_deplibs, $1)=no
       else
 	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
 	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -exports_file $export_symbols -o $lib'
@@ -5803,7 +5825,7 @@ _LT_EOF
       esac
       ;;
 
-    netbsd*)
+    netbsd* | netbsdelf*-gnu)
       if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	_LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags'  # a.out
       else
@@ -6425,7 +6447,7 @@ if test yes != "$_lt_caught_CXX_error"; then
       # Commands to make compiler produce verbose output that lists
       # what "hidden" libraries, object files and flags are used when
       # linking a shared library.
-      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 
     else
       GXX=no
@@ -6800,7 +6822,7 @@ if test yes != "$_lt_caught_CXX_error"; then
             # explicitly linking system object files so we need to strip them
             # from the output so that they don't get included in the library
             # dependencies.
-            output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $EGREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
+            output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $EGREP " \-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
             ;;
           *)
             if test yes = "$GXX"; then
@@ -6865,7 +6887,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	    # explicitly linking system object files so we need to strip them
 	    # from the output so that they don't get included in the library
 	    # dependencies.
-	    output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $GREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
+	    output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $GREP " \-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
 	    ;;
           *)
 	    if test yes = "$GXX"; then
@@ -7204,7 +7226,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	      # Commands to make compiler produce verbose output that lists
 	      # what "hidden" libraries, object files and flags are used when
 	      # linking a shared library.
-	      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 
 	    else
 	      # FIXME: insert proper C++ library support
@@ -7288,7 +7310,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	        # Commands to make compiler produce verbose output that lists
 	        # what "hidden" libraries, object files and flags are used when
 	        # linking a shared library.
-	        output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	        output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 	      else
 	        # g++ 2.7 appears to require '-G' NOT '-shared' on this
 	        # platform.
@@ -7299,7 +7321,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	        # Commands to make compiler produce verbose output that lists
 	        # what "hidden" libraries, object files and flags are used when
 	        # linking a shared library.
-	        output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	        output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 	      fi
 
 	      _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R $wl$libdir'
@@ -9044,9 +9066,9 @@ m4_ifndef([_LT_PROG_F77],		[AC_DEFUN([_LT_PROG_F77])])
 m4_ifndef([_LT_PROG_FC],		[AC_DEFUN([_LT_PROG_FC])])
 m4_ifndef([_LT_PROG_CXX],		[AC_DEFUN([_LT_PROG_CXX])])
 
-# pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
-# serial 11 (pkg-config-0.29.1)
-
+dnl pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
+dnl serial 11 (pkg-config-0.29.1)
+dnl
 dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
 dnl Copyright © 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
 dnl
@@ -9320,74 +9342,6 @@ AS_VAR_COPY([$1], [pkg_cv_][$1])
 AS_VAR_IF([$1], [""], [$5], [$4])dnl
 ])dnl PKG_CHECK_VAR
 
-dnl PKG_WITH_MODULES(VARIABLE-PREFIX, MODULES,
-dnl   [ACTION-IF-FOUND],[ACTION-IF-NOT-FOUND],
-dnl   [DESCRIPTION], [DEFAULT])
-dnl ------------------------------------------
-dnl
-dnl Prepare a "--with-" configure option using the lowercase
-dnl [VARIABLE-PREFIX] name, merging the behaviour of AC_ARG_WITH and
-dnl PKG_CHECK_MODULES in a single macro.
-AC_DEFUN([PKG_WITH_MODULES],
-[
-m4_pushdef([with_arg], m4_tolower([$1]))
-
-m4_pushdef([description],
-           [m4_default([$5], [build with ]with_arg[ support])])
-
-m4_pushdef([def_arg], [m4_default([$6], [auto])])
-m4_pushdef([def_action_if_found], [AS_TR_SH([with_]with_arg)=yes])
-m4_pushdef([def_action_if_not_found], [AS_TR_SH([with_]with_arg)=no])
-
-m4_case(def_arg,
-            [yes],[m4_pushdef([with_without], [--without-]with_arg)],
-            [m4_pushdef([with_without],[--with-]with_arg)])
-
-AC_ARG_WITH(with_arg,
-     AS_HELP_STRING(with_without, description[ @<:@default=]def_arg[@:>@]),,
-    [AS_TR_SH([with_]with_arg)=def_arg])
-
-AS_CASE([$AS_TR_SH([with_]with_arg)],
-            [yes],[PKG_CHECK_MODULES([$1],[$2],$3,$4)],
-            [auto],[PKG_CHECK_MODULES([$1],[$2],
-                                        [m4_n([def_action_if_found]) $3],
-                                        [m4_n([def_action_if_not_found]) $4])])
-
-m4_popdef([with_arg])
-m4_popdef([description])
-m4_popdef([def_arg])
-
-])dnl PKG_WITH_MODULES
-
-dnl PKG_HAVE_WITH_MODULES(VARIABLE-PREFIX, MODULES,
-dnl   [DESCRIPTION], [DEFAULT])
-dnl -----------------------------------------------
-dnl
-dnl Convenience macro to trigger AM_CONDITIONAL after PKG_WITH_MODULES
-dnl check._[VARIABLE-PREFIX] is exported as make variable.
-AC_DEFUN([PKG_HAVE_WITH_MODULES],
-[
-PKG_WITH_MODULES([$1],[$2],,,[$3],[$4])
-
-AM_CONDITIONAL([HAVE_][$1],
-               [test "$AS_TR_SH([with_]m4_tolower([$1]))" = "yes"])
-])dnl PKG_HAVE_WITH_MODULES
-
-dnl PKG_HAVE_DEFINE_WITH_MODULES(VARIABLE-PREFIX, MODULES,
-dnl   [DESCRIPTION], [DEFAULT])
-dnl ------------------------------------------------------
-dnl
-dnl Convenience macro to run AM_CONDITIONAL and AC_DEFINE after
-dnl PKG_WITH_MODULES check. HAVE_[VARIABLE-PREFIX] is exported as make
-dnl and preprocessor variable.
-AC_DEFUN([PKG_HAVE_DEFINE_WITH_MODULES],
-[
-PKG_HAVE_WITH_MODULES([$1],[$2],[$3],[$4])
-
-AS_IF([test "$AS_TR_SH([with_]m4_tolower([$1]))" = "yes"],
-        [AC_DEFINE([HAVE_][$1], 1, [Enable ]m4_tolower([$1])[ support])])
-])dnl PKG_HAVE_DEFINE_WITH_MODULES
-
 # AM_CONDITIONAL                                            -*- Autoconf -*-
 
 # Copyright (C) 1997-2018 Free Software Foundation, Inc.
diff --git a/acx_nlnetlabs.m4 b/acx_nlnetlabs.m4
index 8eccc15b0..31e43d67e 100644
--- a/acx_nlnetlabs.m4
+++ b/acx_nlnetlabs.m4
@@ -2,7 +2,8 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 34
+# Version 35
+# 2020-08-24 Use EVP_sha256 instead of HMAC_Update (for openssl-3.0.0).
 # 2016-03-21 Check -ldl -pthread for libcrypto for ldns and openssl 1.1.0.
 # 2016-03-21 Use HMAC_Update instead of HMAC_CTX_Init (for openssl-1.1.0).
 # 2016-01-04 -D_DEFAULT_SOURCE defined with -D_BSD_SOURCE for Linux glibc 2.20
@@ -673,16 +674,16 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                 ACX_RUNTIME_PATH_ADD([$ssldir/lib])
             fi
         
-            AC_MSG_CHECKING([for HMAC_Update in -lcrypto])
+            AC_MSG_CHECKING([for EVP_sha256 in -lcrypto])
             LIBS="$LIBS -lcrypto"
             LIBSSL_LIBS="$LIBSSL_LIBS -lcrypto"
             AC_TRY_LINK(, [
-                int HMAC_Update(void);
-                (void)HMAC_Update();
+                int EVP_sha256(void);
+                (void)EVP_sha256();
               ], [
                 AC_MSG_RESULT(yes)
-                AC_DEFINE([HAVE_HMAC_UPDATE], 1, 
-                          [If you have HMAC_Update])
+                AC_DEFINE([HAVE_EVP_SHA256], 1,
+                          [If you have EVP_sha256])
               ], [
                 AC_MSG_RESULT(no)
                 # check if -lwsock32 or -lgdi32 are needed.	
@@ -692,11 +693,11 @@ AC_DEFUN([ACX_SSL_CHECKS], [
 		LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32 -lws2_32"
                 AC_MSG_CHECKING([if -lcrypto needs -lgdi32])
                 AC_TRY_LINK([], [
-                    int HMAC_Update(void);
-                    (void)HMAC_Update();
+                    int EVP_sha256(void);
+                    (void)EVP_sha256();
                   ],[
-                    AC_DEFINE([HAVE_HMAC_UPDATE], 1, 
-                        [If you have HMAC_Update])
+                    AC_DEFINE([HAVE_EVP_SHA256], 1,
+                        [If you have EVP_sha256])
                     AC_MSG_RESULT(yes) 
                   ],[
                     AC_MSG_RESULT(no)
@@ -706,11 +707,11 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                     LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
                     AC_MSG_CHECKING([if -lcrypto needs -ldl])
                     AC_TRY_LINK([], [
-                        int HMAC_Update(void);
-                        (void)HMAC_Update();
+                        int EVP_sha256(void);
+                        (void)EVP_sha256();
                       ],[
-                        AC_DEFINE([HAVE_HMAC_UPDATE], 1, 
-                            [If you have HMAC_Update])
+                        AC_DEFINE([HAVE_EVP_SHA256], 1,
+                            [If you have EVP_sha256])
                         AC_MSG_RESULT(yes) 
                       ],[
                         AC_MSG_RESULT(no)
@@ -720,11 +721,11 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                         LIBSSL_LIBS="$LIBSSL_LIBS -ldl -pthread"
                         AC_MSG_CHECKING([if -lcrypto needs -ldl -pthread])
                         AC_TRY_LINK([], [
-                            int HMAC_Update(void);
-                            (void)HMAC_Update();
+                            int EVP_sha256(void);
+                            (void)EVP_sha256();
                           ],[
-                            AC_DEFINE([HAVE_HMAC_UPDATE], 1, 
-                                [If you have HMAC_Update])
+                            AC_DEFINE([HAVE_EVP_SHA256], 1,
+                                [If you have EVP_sha256])
                             AC_MSG_RESULT(yes) 
                           ],[
                             AC_MSG_RESULT(no)
diff --git a/config.h.in b/config.h.in
index 9f70414a3..f993b81b0 100644
--- a/config.h.in
+++ b/config.h.in
@@ -225,6 +225,9 @@
 /* Define to 1 if you have the `EVP_EncryptInit_ex' function. */
 #undef HAVE_EVP_ENCRYPTINIT_EX
 
+/* Define to 1 if you have the `EVP_MAC_CTX_set_params' function. */
+#undef HAVE_EVP_MAC_CTX_SET_PARAMS
+
 /* Define to 1 if you have the `EVP_MD_CTX_new' function. */
 #undef HAVE_EVP_MD_CTX_NEW
 
@@ -273,6 +276,9 @@
 /* Define to 1 if you have the `getentropy' function. */
 #undef HAVE_GETENTROPY
 
+/* Define to 1 if you have the `getifaddrs' function. */
+#undef HAVE_GETIFADDRS
+
 /* Define to 1 if you have the <getopt.h> header file. */
 #undef HAVE_GETOPT_H
 
@@ -300,12 +306,12 @@
 /* Define to 1 if you have the `HMAC_Init_ex' function. */
 #undef HAVE_HMAC_INIT_EX
 
-/* If you have HMAC_Update */
-#undef HAVE_HMAC_UPDATE
-
 /* If we have htobe64 */
 #undef HAVE_HTOBE64
 
+/* Define to 1 if you have the <ifaddrs.h> header file. */
+#undef HAVE_IFADDRS_H
+
 /* Define to 1 if you have the `inet_aton' function. */
 #undef HAVE_INET_ATON
 
@@ -375,6 +381,9 @@
 /* Define to 1 if you have the <nettle/eddsa.h> header file. */
 #undef HAVE_NETTLE_EDDSA_H
 
+/* Define to 1 if you have the <net/if.h> header file. */
+#undef HAVE_NET_IF_H
+
 /* Define this to use nghttp2 client. */
 #undef HAVE_NGHTTP2
 
@@ -396,6 +405,9 @@
 /* Define to 1 if you have the <openssl/conf.h> header file. */
 #undef HAVE_OPENSSL_CONF_H
 
+/* Define to 1 if you have the <openssl/core_names.h> header file. */
+#undef HAVE_OPENSSL_CORE_NAMES_H
+
 /* Define to 1 if you have the <openssl/dh.h> header file. */
 #undef HAVE_OPENSSL_DH_H
 
@@ -513,8 +525,9 @@
 /* Define to 1 if you have the `SSL_CTX_set_security_level' function. */
 #undef HAVE_SSL_CTX_SET_SECURITY_LEVEL
 
-/* Define to 1 if you have the `SSL_CTX_set_tlsext_ticket_key_cb' function. */
-#undef HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_CB
+/* Define to 1 if you have the `SSL_CTX_set_tlsext_ticket_key_evp_cb'
+   function. */
+#undef HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_EVP_CB
 
 /* Define to 1 if you have the `SSL_get0_peername' function. */
 #undef HAVE_SSL_GET0_PEERNAME
@@ -582,6 +595,9 @@
 /* Define to 1 if you have the <sys/resource.h> header file. */
 #undef HAVE_SYS_RESOURCE_H
 
+/* Define to 1 if you have the <sys/select.h> header file. */
+#undef HAVE_SYS_SELECT_H
+
 /* Define to 1 if you have the <sys/sha2.h> header file. */
 #undef HAVE_SYS_SHA2_H
 
diff --git a/configure b/configure
index 049e1a811..680722769 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for unbound 1.10.2.
+# Generated by GNU Autoconf 2.69 for unbound 1.11.1.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues>.
 #
@@ -591,8 +591,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.10.2'
-PACKAGE_STRING='unbound 1.10.2'
+PACKAGE_VERSION='1.11.1'
+PACKAGE_STRING='unbound 1.11.1'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues'
 PACKAGE_URL=''
 
@@ -1470,7 +1470,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 1.10.2 to adapt to many kinds of systems.
+\`configure' configures unbound 1.11.1 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1536,7 +1536,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.10.2:";;
+     short | recursive ) echo "Configuration of unbound 1.11.1:";;
    esac
   cat <<\_ACEOF
 
@@ -1764,7 +1764,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 1.10.2
+unbound configure 1.11.1
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2473,7 +2473,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 1.10.2, which was
+It was created by unbound $as_me 1.11.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2823,13 +2823,13 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 UNBOUND_VERSION_MAJOR=1
 
-UNBOUND_VERSION_MINOR=10
+UNBOUND_VERSION_MINOR=11
 
-UNBOUND_VERSION_MICRO=2
+UNBOUND_VERSION_MICRO=1
 
 
 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=9
+LIBUNBOUND_REVISION=10
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -2905,7 +2905,8 @@ LIBUNBOUND_AGE=1
 # 1.9.6 had 9:6:1
 # 1.10.0 had 9:7:1
 # 1.10.1 had 9:8:1
-# 1.10.2 had 9:9:1
+# 1.11.0 had 9:9:1
+# 1.11.1 had 9:10:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -8080,7 +8081,7 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   lt_cv_deplibs_check_method=pass_all
   ;;
 
-netbsd*)
+netbsd* | netbsdelf*-gnu)
   if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then
     lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so\.[0-9]+\.[0-9]+|_pic\.a)$'
   else
@@ -8442,7 +8443,7 @@ esac
 fi
 
 : ${AR=ar}
-: ${AR_FLAGS=cru}
+: ${AR_FLAGS=cr}
 
 
 
@@ -8985,11 +8986,8 @@ _LT_EOF
   test $ac_status = 0; }; then
     # Now try to grab the symbols.
     nlist=conftest.nm
-    if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist\""; } >&5
-  (eval $NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist) 2>&5
-  ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-  test $ac_status = 0; } && test -s "$nlist"; then
+    $ECHO "$as_me:$LINENO: $NM conftest.$ac_objext | $lt_cv_sys_global_symbol_pipe > $nlist" >&5
+    if eval "$NM" conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist 2>&5 && test -s "$nlist"; then
       # Try sorting and uniquifying the output.
       if sort "$nlist" | uniq > "$nlist"T; then
 	mv -f "$nlist"T "$nlist"
@@ -10208,8 +10206,8 @@ int forced_loaded() { return 2;}
 _LT_EOF
       echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&5
       $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&5
-      echo "$AR cru libconftest.a conftest.o" >&5
-      $AR cru libconftest.a conftest.o 2>&5
+      echo "$AR cr libconftest.a conftest.o" >&5
+      $AR cr libconftest.a conftest.o 2>&5
       echo "$RANLIB libconftest.a" >&5
       $RANLIB libconftest.a 2>&5
       cat > conftest.c << _LT_EOF
@@ -11069,6 +11067,12 @@ lt_prog_compiler_static=
 	lt_prog_compiler_pic='-KPIC'
 	lt_prog_compiler_static='-static'
         ;;
+      # flang / f18. f95 an alias for gfortran or flang on Debian
+      flang* | f18* | f95*)
+	lt_prog_compiler_wl='-Wl,'
+	lt_prog_compiler_pic='-fPIC'
+	lt_prog_compiler_static='-static'
+        ;;
       # icc used to be incompatible with GCC.
       # ICC 10 doesn't accept -KPIC any more.
       icc* | ifort*)
@@ -11545,6 +11549,9 @@ $as_echo_n "checking whether the $compiler linker ($LD) supports shared librarie
   openbsd* | bitrig*)
     with_gnu_ld=no
     ;;
+  linux* | k*bsd*-gnu | gnu*)
+    link_all_deplibs=no
+    ;;
   esac
 
   ld_shlibs=yes
@@ -11799,7 +11806,7 @@ _LT_EOF
       fi
       ;;
 
-    netbsd*)
+    netbsd* | netbsdelf*-gnu)
       if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	archive_cmds='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib'
 	wlarc=
@@ -12469,6 +12476,7 @@ $as_echo "$lt_cv_irix_exported_symbol" >&6; }
 	if test yes = "$lt_cv_irix_exported_symbol"; then
           archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations $wl-exports_file $wl$export_symbols -o $lib'
 	fi
+	link_all_deplibs=no
       else
 	archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
 	archive_expsym_cmds='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -exports_file $export_symbols -o $lib'
@@ -12490,7 +12498,7 @@ $as_echo "$lt_cv_irix_exported_symbol" >&6; }
       esac
       ;;
 
-    netbsd*)
+    netbsd* | netbsdelf*-gnu)
       if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags'  # a.out
       else
@@ -13585,9 +13593,6 @@ fi
   # before this can be enabled.
   hardcode_into_libs=yes
 
-  # Add ABI-specific directories to the system library path.
-  sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /lib /usr/lib"
-
   # Ideally, we could use ldconfig to report *all* directores which are
   # searched for libraries, however this is still not possible.  Aside from not
   # being certain /sbin/ldconfig is available, command
@@ -13596,7 +13601,7 @@ fi
   # appending ld.so.conf contents (and includes) to the search path.
   if test -f /etc/ld.so.conf; then
     lt_ld_extra=`awk '/^include / { system(sprintf("cd /etc; cat %s 2>/dev/null", \$2)); skip = 1; } { if (!skip) print \$0; skip = 0; }' < /etc/ld.so.conf | $SED -e 's/#.*//;/^[	 ]*hwcap[	 ]/d;s/[:,	]/ /g;s/=[^=]*$//;s/=[^= ]* / /g;s/"//g;/^$/d' | tr '\n' ' '`
-    sys_lib_dlsearch_path_spec="$sys_lib_dlsearch_path_spec $lt_ld_extra"
+    sys_lib_dlsearch_path_spec="/lib /usr/lib $lt_ld_extra"
   fi
 
   # We used to test for /lib/ld.so.1 and disable shared libraries on
@@ -13608,6 +13613,18 @@ fi
   dynamic_linker='GNU/Linux ld.so'
   ;;
 
+netbsdelf*-gnu)
+  version_type=linux
+  need_lib_prefix=no
+  need_version=no
+  library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major ${libname}${shared_ext}'
+  soname_spec='${libname}${release}${shared_ext}$major'
+  shlibpath_var=LD_LIBRARY_PATH
+  shlibpath_overrides_runpath=no
+  hardcode_into_libs=yes
+  dynamic_linker='NetBSD ld.elf_so'
+  ;;
+
 netbsd*)
   version_type=sunos
   need_lib_prefix=no
@@ -14739,7 +14756,7 @@ $as_echo "no" >&6; }
 fi
 
 # Checks for header files.
-for ac_header in stdarg.h stdbool.h netinet/in.h netinet/tcp.h sys/param.h sys/socket.h sys/un.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h sys/endian.h libkern/OSByteOrder.h sys/ipc.h sys/shm.h
+for ac_header in stdarg.h stdbool.h netinet/in.h netinet/tcp.h sys/param.h sys/select.h sys/socket.h sys/un.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h sys/endian.h libkern/OSByteOrder.h sys/ipc.h sys/shm.h ifaddrs.h net/if.h
 do :
   as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
 ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
@@ -17956,8 +17973,8 @@ $as_echo "found in $ssldir" >&6; }
 
             fi
 
-            { $as_echo "$as_me:${as_lineno-$LINENO}: checking for HMAC_Update in -lcrypto" >&5
-$as_echo_n "checking for HMAC_Update in -lcrypto... " >&6; }
+            { $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_sha256 in -lcrypto" >&5
+$as_echo_n "checking for EVP_sha256 in -lcrypto... " >&6; }
             LIBS="$LIBS -lcrypto"
             LIBSSL_LIBS="$LIBSSL_LIBS -lcrypto"
             cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -17967,8 +17984,8 @@ int
 main ()
 {
 
-                int HMAC_Update(void);
-                (void)HMAC_Update();
+                int EVP_sha256(void);
+                (void)EVP_sha256();
 
   ;
   return 0;
@@ -17979,7 +17996,7 @@ if ac_fn_c_try_link "$LINENO"; then :
                 { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
 
-$as_echo "#define HAVE_HMAC_UPDATE 1" >>confdefs.h
+$as_echo "#define HAVE_EVP_SHA256 1" >>confdefs.h
 
 
 else
@@ -18000,8 +18017,8 @@ int
 main ()
 {
 
-                    int HMAC_Update(void);
-                    (void)HMAC_Update();
+                    int EVP_sha256(void);
+                    (void)EVP_sha256();
 
   ;
   return 0;
@@ -18010,7 +18027,7 @@ _ACEOF
 if ac_fn_c_try_link "$LINENO"; then :
 
 
-$as_echo "#define HAVE_HMAC_UPDATE 1" >>confdefs.h
+$as_echo "#define HAVE_EVP_SHA256 1" >>confdefs.h
 
                     { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
@@ -18032,8 +18049,8 @@ int
 main ()
 {
 
-                        int HMAC_Update(void);
-                        (void)HMAC_Update();
+                        int EVP_sha256(void);
+                        (void)EVP_sha256();
 
   ;
   return 0;
@@ -18042,7 +18059,7 @@ _ACEOF
 if ac_fn_c_try_link "$LINENO"; then :
 
 
-$as_echo "#define HAVE_HMAC_UPDATE 1" >>confdefs.h
+$as_echo "#define HAVE_EVP_SHA256 1" >>confdefs.h
 
                         { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
@@ -18064,8 +18081,8 @@ int
 main ()
 {
 
-                            int HMAC_Update(void);
-                            (void)HMAC_Update();
+                            int EVP_sha256(void);
+                            (void)EVP_sha256();
 
   ;
   return 0;
@@ -18074,7 +18091,7 @@ _ACEOF
 if ac_fn_c_try_link "$LINENO"; then :
 
 
-$as_echo "#define HAVE_HMAC_UPDATE 1" >>confdefs.h
+$as_echo "#define HAVE_EVP_SHA256 1" >>confdefs.h
 
                             { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
@@ -18259,11 +18276,11 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 #ifdef __cplusplus
 extern "C"
 #endif
-char HMAC_Update ();
+char EVP_sha256 ();
 int
 main ()
 {
-return HMAC_Update ();
+return EVP_sha256 ();
   ;
   return 0;
 }
@@ -18340,7 +18357,7 @@ else
 	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 fi
-for ac_header in openssl/conf.h openssl/engine.h openssl/bn.h openssl/dh.h openssl/dsa.h openssl/rsa.h
+for ac_header in openssl/conf.h openssl/engine.h openssl/bn.h openssl/dh.h openssl/dsa.h openssl/rsa.h openssl/core_names.h
 do :
   as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
 ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
@@ -18354,7 +18371,7 @@ fi
 
 done
 
-for ac_func in OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify SSL_CTX_set_tlsext_ticket_key_cb EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback
+for ac_func in OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params
 do :
   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@@ -18370,7 +18387,7 @@ done
 # these check_funcs need -lssl
 BAKLIBS="$LIBS"
 LIBS="-lssl $LIBS"
-for ac_func in OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername X509_VERIFY_PARAM_set1_host SSL_CTX_set_ciphersuites SSL_CTX_set_alpn_select_cb
+for ac_func in OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername X509_VERIFY_PARAM_set1_host SSL_CTX_set_ciphersuites SSL_CTX_set_tlsext_ticket_key_evp_cb SSL_CTX_set_alpn_select_cb
 do :
   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@@ -20301,7 +20318,7 @@ if test "$ac_res" != no; then :
 
 fi
 
-for ac_func in tzset sigprocmask fcntl getpwnam endpwent getrlimit setrlimit setsid chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent fsync shmget accept4
+for ac_func in tzset sigprocmask fcntl getpwnam endpwent getrlimit setrlimit setsid chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent fsync shmget accept4 getifaddrs
 do :
   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@@ -21697,7 +21714,7 @@ _ACEOF
 
 
 
-version=1.10.2
+version=1.11.1
 
 date=`date +'%b %e, %Y'`
 
@@ -22216,7 +22233,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.10.2, which was
+This file was extended by unbound $as_me 1.11.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -22282,7 +22299,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-unbound config.status 1.10.2
+unbound config.status 1.11.1
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
@@ -23275,7 +23292,6 @@ $as_echo "$as_me: executing $ac_file commands" >&6;}
     cat <<_LT_EOF >> "$cfgfile"
 #! $SHELL
 # Generated automatically by $as_me ($PACKAGE) $VERSION
-# Libtool was configured on host `(hostname || uname -n) 2>/dev/null | sed 1q`:
 # NOTE: Changes made to this file will be lost: look at ltmain.sh.
 
 # Provide generalized library-building support services.
diff --git a/configure.ac b/configure.ac
index 53e815b1f..8ccfafe6c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -10,15 +10,15 @@ sinclude(dnscrypt/dnscrypt.m4)
 
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
-m4_define([VERSION_MINOR],[10])
-m4_define([VERSION_MICRO],[2])
+m4_define([VERSION_MINOR],[11])
+m4_define([VERSION_MICRO],[1])
 AC_INIT(unbound, m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]), unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues, unbound)
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
 
 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=9
+LIBUNBOUND_REVISION=10
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -94,7 +94,8 @@ LIBUNBOUND_AGE=1
 # 1.9.6 had 9:6:1
 # 1.10.0 had 9:7:1
 # 1.10.1 had 9:8:1
-# 1.10.2 had 9:9:1
+# 1.11.0 had 9:9:1
+# 1.11.1 had 9:10:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -398,7 +399,7 @@ ACX_LIBTOOL_C_ONLY
 PKG_PROG_PKG_CONFIG
 
 # Checks for header files.
-AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h netinet/tcp.h sys/param.h sys/socket.h sys/un.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h sys/endian.h libkern/OSByteOrder.h sys/ipc.h sys/shm.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h netinet/tcp.h sys/param.h sys/select.h sys/socket.h sys/un.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h sys/endian.h libkern/OSByteOrder.h sys/ipc.h sys/shm.h ifaddrs.h net/if.h],,, [AC_INCLUDES_DEFAULT])
 
 # Check for Apple header. This uncovers TARGET_OS_IPHONE, TARGET_OS_TV or TARGET_OS_WATCH
 AC_CHECK_HEADERS([TargetConditionals.h])
@@ -831,7 +832,7 @@ AC_SUBST(PC_CRYPTO_DEPENDENCY)
 BAKLIBS="$LIBS"
 LIBS="-lssl $LIBS"
 AC_MSG_CHECKING([if libssl needs -lcrypt32])
-AC_TRY_LINK_FUNC([HMAC_Update], [
+AC_TRY_LINK_FUNC([EVP_sha256], [
 	AC_MSG_RESULT([no])
 	LIBS="$BAKLIBS"
 ], [
@@ -850,13 +851,13 @@ if grep VERSION_TEXT $ssldir/include/openssl/opensslv.h | grep "LibreSSL" >/dev/
 else
 	AC_MSG_RESULT([no])
 fi
-AC_CHECK_HEADERS([openssl/conf.h openssl/engine.h openssl/bn.h openssl/dh.h openssl/dsa.h openssl/rsa.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify SSL_CTX_set_tlsext_ticket_key_cb EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback])
+AC_CHECK_HEADERS([openssl/conf.h openssl/engine.h openssl/bn.h openssl/dh.h openssl/dsa.h openssl/rsa.h openssl/core_names.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params])
 
 # these check_funcs need -lssl
 BAKLIBS="$LIBS"
 LIBS="-lssl $LIBS"
-AC_CHECK_FUNCS([OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername X509_VERIFY_PARAM_set1_host SSL_CTX_set_ciphersuites SSL_CTX_set_alpn_select_cb])
+AC_CHECK_FUNCS([OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername X509_VERIFY_PARAM_set1_host SSL_CTX_set_ciphersuites SSL_CTX_set_tlsext_ticket_key_evp_cb SSL_CTX_set_alpn_select_cb])
 LIBS="$BAKLIBS"
 
 AC_CHECK_DECLS([SSL_COMP_get_compression_methods,sk_SSL_COMP_pop_free,SSL_CTX_set_ecdh_auto], [], [], [
@@ -1584,7 +1585,7 @@ AC_LINK_IFELSE([AC_LANG_PROGRAM([
   AC_MSG_RESULT(no))
 
 AC_SEARCH_LIBS([setusercontext], [util])
-AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam endpwent getrlimit setrlimit setsid chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent fsync shmget accept4])
+AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam endpwent getrlimit setrlimit setsid chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent fsync shmget accept4 getifaddrs])
 AC_CHECK_FUNCS([setresuid],,[AC_CHECK_FUNCS([setreuid])])
 AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])
 
diff --git a/contrib/aaaa-filter-iterator.patch b/contrib/aaaa-filter-iterator.patch
index 9881bde89..f51de2a40 100644
--- a/contrib/aaaa-filter-iterator.patch
+++ b/contrib/aaaa-filter-iterator.patch
@@ -1,10 +1,10 @@
-Index: trunk/doc/unbound.conf.5.in
-===================================================================
---- trunk/doc/unbound.conf.5.in	(revision 4357)
-+++ trunk/doc/unbound.conf.5.in	(working copy)
-@@ -701,6 +701,13 @@
+diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
+index f426ac5f..147fbfa9 100644
+--- a/doc/unbound.conf.5.in
++++ b/doc/unbound.conf.5.in
+@@ -872,6 +872,13 @@ potentially broken nameservers. A lot of domains will not be resolvable when
  this option in enabled. Only use if you know what you are doing.
- This option only has effect when qname-minimisation is enabled. Default is off.
+ This option only has effect when qname-minimisation is enabled. Default is no.
  .TP
 +.B aaaa\-filter: \fI<yes or no>
 +Activate behavior similar to BIND's AAAA-filter.
@@ -16,14 +16,15 @@ Index: trunk/doc/unbound.conf.5.in
  .B aggressive\-nsec: \fI<yes or no>
  Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN
  and other denials, using information from previous NXDOMAINs answers.
-Index: trunk/iterator/iter_scrub.c
-===================================================================
---- trunk/iterator/iter_scrub.c	(revision 4357)
-+++ trunk/iterator/iter_scrub.c	(working copy)
-@@ -617,6 +617,32 @@
+diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c
+index aae934dd..55c55de0 100644
+--- a/iterator/iter_scrub.c
++++ b/iterator/iter_scrub.c
+@@ -667,6 +667,32 @@ static int sanitize_nsec_is_overreach(struct rrset_parse* rrset,
+ 	return 0;
  }
  
- /**
++/**
 + * ASN: Lookup A records from rrset cache.
 + * @param qinfo: the question originally asked.
 + * @param env: module environment with config and cache.
@@ -49,11 +50,10 @@ Index: trunk/iterator/iter_scrub.c
 +	return 0;
 +}
 +
-+/**
+ /**
   * Given a response event, remove suspect RRsets from the response.
   * "Suspect" rrsets are potentially poison. Note that this routine expects
-  * the response to be in a "normalized" state -- that is, all "irrelevant"
-@@ -635,6 +661,7 @@
+@@ -686,6 +712,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
  	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
  	struct iter_env* ie)
  {
@@ -61,7 +61,7 @@ Index: trunk/iterator/iter_scrub.c
  	int del_addi = 0; /* if additional-holding rrsets are deleted, we
  		do not trust the normalized additional-A-AAAA any more */
  	struct rrset_parse* rrset, *prev;
-@@ -670,6 +697,13 @@
+@@ -721,6 +748,13 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
  		rrset = rrset->rrset_all_next;
  	}
  
@@ -75,11 +75,10 @@ Index: trunk/iterator/iter_scrub.c
  	/* At this point, we brutally remove ALL rrsets that aren't 
  	 * children of the originating zone. The idea here is that, 
  	 * as far as we know, the server that we contacted is ONLY 
-@@ -680,6 +714,24 @@
- 	prev = NULL;
+@@ -732,6 +766,24 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
  	rrset = msg->rrset_first;
  	while(rrset) {
-+
+ 
 +		/* ASN: For AAAA records only... */
 +		if((ie->aaaa_filter) && (rrset->type == LDNS_RR_TYPE_AAAA)) {
 +			/* ASN: If this is not a AAAA query, then remove AAAA
@@ -97,14 +96,15 @@ Index: trunk/iterator/iter_scrub.c
 +				LDNS_RR_TYPE_AAAA, qinfo->qclass);
 +		}
 +		/* ASN: End of added code */
- 
++
  		/* remove private addresses */
  		if( (rrset->type == LDNS_RR_TYPE_A || 
-Index: trunk/iterator/iter_utils.c
-===================================================================
---- trunk/iterator/iter_utils.c	(revision 4357)
-+++ trunk/iterator/iter_utils.c	(working copy)
-@@ -175,6 +175,7 @@
+ 			rrset->type == LDNS_RR_TYPE_AAAA)) {
+diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c
+index 7bc67da6..e10f547a 100644
+--- a/iterator/iter_utils.c
++++ b/iterator/iter_utils.c
+@@ -175,6 +175,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
  	}
  	iter_env->supports_ipv6 = cfg->do_ip6;
  	iter_env->supports_ipv4 = cfg->do_ip4;
@@ -112,11 +112,11 @@ Index: trunk/iterator/iter_utils.c
  	return 1;
  }
  
-Index: trunk/iterator/iterator.c
-===================================================================
---- trunk/iterator/iterator.c	(revision 4357)
-+++ trunk/iterator/iterator.c	(working copy)
-@@ -1847,6 +1847,53 @@
+diff --git a/iterator/iterator.c b/iterator/iterator.c
+index 23b07ea9..ca29b48c 100644
+--- a/iterator/iterator.c
++++ b/iterator/iterator.c
+@@ -2127,6 +2127,53 @@ processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id)
  
  	return 0;
  }
@@ -170,7 +170,7 @@ Index: trunk/iterator/iterator.c
  	
  /** 
   * This is the request event state where the request will be sent to one of
-@@ -1894,6 +1941,13 @@
+@@ -2186,6 +2233,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
  		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
  	}
  	
@@ -184,7 +184,7 @@ Index: trunk/iterator/iterator.c
  	/* Make sure we have a delegation point, otherwise priming failed
  	 * or another failure occurred */
  	if(!iq->dp) {
-@@ -3095,6 +3149,61 @@
+@@ -3574,6 +3628,61 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
  	return 0;
  }
  
@@ -246,7 +246,7 @@ Index: trunk/iterator/iterator.c
  /*
   * Return priming query results to interested super querystates.
   * 
-@@ -3114,6 +3223,9 @@
+@@ -3593,6 +3702,9 @@ iter_inform_super(struct module_qstate* qstate, int id,
  	else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
  		super->minfo[id])->state == DSNS_FIND_STATE)
  		processDSNSResponse(qstate, id, super);
@@ -256,7 +256,7 @@ Index: trunk/iterator/iterator.c
  	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
  		error_supers(qstate, id, super);
  	else if(qstate->is_priming)
-@@ -3151,6 +3263,9 @@
+@@ -3630,6 +3742,9 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
  			case INIT_REQUEST_3_STATE:
  				cont = processInitRequest3(qstate, iq, id);
  				break;
@@ -266,7 +266,7 @@ Index: trunk/iterator/iterator.c
  			case QUERYTARGETS_STATE:
  				cont = processQueryTargets(qstate, iq, ie, id);
  				break;
-@@ -3460,6 +3575,8 @@
+@@ -3961,6 +4076,8 @@ iter_state_to_string(enum iter_state state)
  		return "INIT REQUEST STATE (stage 2)";
  	case INIT_REQUEST_3_STATE:
  		return "INIT REQUEST STATE (stage 3)";
@@ -275,7 +275,7 @@ Index: trunk/iterator/iterator.c
  	case QUERYTARGETS_STATE :
  		return "QUERY TARGETS STATE";
  	case PRIME_RESP_STATE :
-@@ -3484,6 +3601,7 @@
+@@ -3985,6 +4102,7 @@ iter_state_is_responsestate(enum iter_state s)
  		case INIT_REQUEST_STATE :
  		case INIT_REQUEST_2_STATE :
  		case INIT_REQUEST_3_STATE :
@@ -283,11 +283,11 @@ Index: trunk/iterator/iterator.c
  		case QUERYTARGETS_STATE :
  		case COLLECT_CLASS_STATE :
  			return 0;
-Index: trunk/iterator/iterator.h
-===================================================================
---- trunk/iterator/iterator.h	(revision 4357)
-+++ trunk/iterator/iterator.h	(working copy)
-@@ -130,6 +130,9 @@
+diff --git a/iterator/iterator.h b/iterator/iterator.h
+index 342ac207..731948d1 100644
+--- a/iterator/iterator.h
++++ b/iterator/iterator.h
+@@ -135,6 +135,9 @@ struct iter_env {
  	 */
  	int* target_fetch_policy;
  
@@ -297,10 +297,11 @@ Index: trunk/iterator/iterator.h
  	/** lock on ratelimit counter */
  	lock_basic_type queries_ratelimit_lock;
  	/** number of queries that have been ratelimited */
-@@ -182,6 +185,14 @@
+@@ -186,6 +189,14 @@ enum iter_state {
+ 	 */
  	INIT_REQUEST_3_STATE,
  
- 	/**
++	/**
 +	 * This state is responsible for intercepting AAAA queries,
 +	 * and launch a A subquery on the same target, to populate the
 +	 * cache with A records, so the AAAA filter scrubbing logic can
@@ -308,29 +309,28 @@ Index: trunk/iterator/iterator.h
 +	 */
 +	ASN_FETCH_A_FOR_AAAA_STATE,
 +
-+	/**
+ 	/**
  	 * Each time a delegation point changes for a given query or a 
  	 * query times out and/or wakes up, this state is (re)visited. 
- 	 * This state is responsible for iterating through a list of 
-@@ -364,6 +375,13 @@
- 	 * be used when creating the state. A higher one will be attempted.
+@@ -375,6 +386,13 @@ struct iter_qstate {
  	 */
  	int refetch_glue;
-+
+ 
 +	/**
 +	 * ASN: This is a flag that, if true, means that this query is
 +	 * for fetching A records to populate cache and determine if we must
 +	 * return AAAA records or not.
 +	 */
 +	int fetch_a_for_aaaa;
- 
++
  	/** list of pending queries to authoritative servers. */
  	struct outbound_list outlist;
-Index: trunk/pythonmod/interface.i
-===================================================================
---- trunk/pythonmod/interface.i	(revision 4357)
-+++ trunk/pythonmod/interface.i	(working copy)
-@@ -851,6 +851,7 @@
+ 
+diff --git a/pythonmod/interface.i b/pythonmod/interface.i
+index f08b575d..47f1bb2e 100644
+--- a/pythonmod/interface.i
++++ b/pythonmod/interface.i
+@@ -975,6 +975,7 @@ struct config_file {
     int harden_dnssec_stripped;
     int harden_referral_path;
     int use_caps_bits_for_id;
@@ -338,11 +338,11 @@ Index: trunk/pythonmod/interface.i
     struct config_strlist* private_address;
     struct config_strlist* private_domain;
     size_t unwanted_threshold;
-Index: trunk/util/config_file.c
-===================================================================
---- trunk/util/config_file.c	(revision 4357)
-+++ trunk/util/config_file.c	(working copy)
-@@ -195,6 +195,7 @@
+diff --git a/util/config_file.c b/util/config_file.c
+index 0ab8614a..729fb147 100644
+--- a/util/config_file.c
++++ b/util/config_file.c
+@@ -218,6 +218,7 @@ config_create(void)
  	cfg->harden_referral_path = 0;
  	cfg->harden_algo_downgrade = 0;
  	cfg->use_caps_bits_for_id = 0;
@@ -350,11 +350,11 @@ Index: trunk/util/config_file.c
  	cfg->caps_whitelist = NULL;
  	cfg->private_address = NULL;
  	cfg->private_domain = NULL;
-Index: trunk/util/config_file.h
-===================================================================
---- trunk/util/config_file.h	(revision 4357)
-+++ trunk/util/config_file.h	(working copy)
-@@ -209,6 +209,8 @@
+diff --git a/util/config_file.h b/util/config_file.h
+index e61257a3..dabaa7bb 100644
+--- a/util/config_file.h
++++ b/util/config_file.h
+@@ -260,6 +260,8 @@ struct config_file {
  	int harden_algo_downgrade;
  	/** use 0x20 bits in query as random ID bits */
  	int use_caps_bits_for_id;
@@ -363,11 +363,11 @@ Index: trunk/util/config_file.h
  	/** 0x20 whitelist, domains that do not use capsforid */
  	struct config_strlist* caps_whitelist;
  	/** strip away these private addrs from answers, no DNS Rebinding */
-Index: trunk/util/configlexer.lex
-===================================================================
---- trunk/util/configlexer.lex	(revision 4357)
-+++ trunk/util/configlexer.lex	(working copy)
-@@ -279,6 +279,7 @@
+diff --git a/util/configlexer.lex b/util/configlexer.lex
+index 79a0edca..4eaec678 100644
+--- a/util/configlexer.lex
++++ b/util/configlexer.lex
+@@ -304,6 +304,7 @@ harden-algo-downgrade{COLON}	{ YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
  use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
  caps-whitelist{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
  unwanted-reply-threshold{COLON}	{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
@@ -375,11 +375,11 @@ Index: trunk/util/configlexer.lex
  private-address{COLON}		{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
  private-domain{COLON}		{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
  prefetch-key{COLON}		{ YDVAR(1, VAR_PREFETCH_KEY) }
-Index: trunk/util/configparser.y
-===================================================================
---- trunk/util/configparser.y	(revision 4357)
-+++ trunk/util/configparser.y	(working copy)
-@@ -95,6 +95,7 @@
+diff --git a/util/configparser.y b/util/configparser.y
+index 1d0e8658..f284dd43 100644
+--- a/util/configparser.y
++++ b/util/configparser.y
+@@ -97,6 +97,7 @@ extern struct config_parser_state* cfg_parser;
  %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT 
  %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR
  %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS
@@ -387,7 +387,7 @@ Index: trunk/util/configparser.y
  %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
  %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
  %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
-@@ -203,6 +204,7 @@
+@@ -233,6 +234,7 @@ content_server: server_num_threads | server_verbosity | server_port |
  	server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size |
  	server_harden_referral_path | server_private_address |
  	server_private_domain | server_extended_statistics | 
@@ -395,12 +395,10 @@ Index: trunk/util/configparser.y
  	server_local_data_ptr | server_jostle_timeout | 
  	server_unwanted_reply_threshold | server_log_time_ascii | 
  	server_domain_insecure | server_val_sig_skew_min | 
-@@ -1183,6 +1185,15 @@
- 		OUTYY(("P(server_caps_whitelist:%s)\n", $2));
- 		if(!cfg_strlist_insert(&cfg_parser->cfg->caps_whitelist, $2))
+@@ -1563,6 +1565,15 @@ server_caps_whitelist: VAR_CAPS_WHITELIST STRING_ARG
  			yyerror("out of memory");
-+	}
-+	;
+ 	}
+ 	;
 +server_aaaa_filter: VAR_AAAA_FILTER STRING_ARG
 +	{
 +		OUTYY(("P(server_aaaa_filter:%s)\n", $2));
@@ -408,6 +406,8 @@ Index: trunk/util/configparser.y
 +			yyerror("expected yes or no.");
 +		else cfg_parser->cfg->aaaa_filter = (strcmp($2, "yes")==0);
 +		free($2);
- 	}
- 	;
++	}
++	;
  server_private_address: VAR_PRIVATE_ADDRESS STRING_ARG
+ 	{
+ 		OUTYY(("P(server_private_address:%s)\n", $2));
diff --git a/contrib/fastrpz.patch b/contrib/fastrpz.patch
index aacd5ab82..5b3c18a7c 100644
--- a/contrib/fastrpz.patch
+++ b/contrib/fastrpz.patch
@@ -2,7 +2,7 @@ Description: based on the included patch contrib/fastrpz.patch
 Author: fastrpz@farsightsecurity.com
 ---
 diff --git a/Makefile.in b/Makefile.in
-index a20058cc..495779cc 100644
+index bac212df..4824927f 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -23,6 +23,8 @@ CHECKLOCK_SRC=testcode/checklocks.c
@@ -13,8 +13,8 @@ index a20058cc..495779cc 100644
 +FASTRPZ_OBJ=@FASTRPZ_OBJ@
  DNSCRYPT_SRC=@DNSCRYPT_SRC@
  DNSCRYPT_OBJ=@DNSCRYPT_OBJ@
- WITH_PYTHONMODULE=@WITH_PYTHONMODULE@
-@@ -127,7 +129,7 @@ validator/val_sigcrypt.c validator/val_utils.c dns64/dns64.c \
+ WITH_DYNLIBMODULE=@WITH_DYNLIBMODULE@
+@@ -134,7 +136,7 @@ validator/val_sigcrypt.c validator/val_utils.c dns64/dns64.c \
  edns-subnet/edns-subnet.c edns-subnet/subnetmod.c \
  edns-subnet/addrtree.c edns-subnet/subnet-whitelist.c \
  cachedb/cachedb.c cachedb/redis.c respip/respip.c $(CHECKLOCK_SRC) \
@@ -23,16 +23,16 @@ index a20058cc..495779cc 100644
  COMMON_OBJ_WITHOUT_NETCALL=dns.lo infra.lo rrset.lo dname.lo msgencode.lo \
  as112.lo msgparse.lo msgreply.lo packed_rrset.lo iterator.lo iter_delegpt.lo \
  iter_donotq.lo iter_fwd.lo iter_hints.lo iter_priv.lo iter_resptype.lo \
-@@ -140,7 +142,7 @@ autotrust.lo val_anchor.lo rpz.lo \
+@@ -147,7 +149,7 @@ autotrust.lo val_anchor.lo rpz.lo \
  validator.lo val_kcache.lo val_kentry.lo val_neg.lo val_nsec3.lo val_nsec.lo \
  val_secalgo.lo val_sigcrypt.lo val_utils.lo dns64.lo cachedb.lo redis.lo authzone.lo \
  $(SUBNET_OBJ) $(PYTHONMOD_OBJ) $(CHECKLOCK_OBJ) $(DNSTAP_OBJ) $(DNSCRYPT_OBJ) \
--$(IPSECMOD_OBJ) $(IPSET_OBJ) respip.lo
-+$(FASTRPZ_OBJ) $(IPSECMOD_OBJ) $(IPSET_OBJ) respip.lo
+-$(IPSECMOD_OBJ) $(IPSET_OBJ) $(DYNLIBMOD_OBJ) respip.lo
++$(FASTRPZ_OBJ) $(IPSECMOD_OBJ) $(IPSET_OBJ) $(DYNLIBMOD_OBJ) respip.lo
  COMMON_OBJ_WITHOUT_UB_EVENT=$(COMMON_OBJ_WITHOUT_NETCALL) netevent.lo listen_dnsport.lo \
  outside_network.lo
  COMMON_OBJ=$(COMMON_OBJ_WITHOUT_UB_EVENT) ub_event.lo
-@@ -410,6 +412,11 @@ dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h \
+@@ -428,6 +430,11 @@ dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h \
  	$(srcdir)/util/config_file.h $(srcdir)/util/log.h \
  	$(srcdir)/util/netevent.h
  
@@ -45,10 +45,10 @@ index a20058cc..495779cc 100644
  pythonmod.lo pythonmod.o: $(srcdir)/pythonmod/pythonmod.c config.h \
  	pythonmod/interface.h \
 diff --git a/config.h.in b/config.h.in
-index 78d47fed..e33073e4 100644
+index f7a4095e..d5a4fa01 100644
 --- a/config.h.in
 +++ b/config.h.in
-@@ -1345,4 +1345,11 @@ void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
+@@ -1364,4 +1364,11 @@ void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
  /** the version of unbound-control that this software implements */
  #define UNBOUND_CONTROL_VERSION 1
  
@@ -62,7 +62,7 @@ index 78d47fed..e33073e4 100644
 +/** turn on fastrpz response policy zones */
 +#undef ENABLE_FASTRPZ
 diff --git a/configure.ac b/configure.ac
-index 2b91dd3c..e6063d17 100644
+index 5c373d9d..e45abd89 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -6,6 +6,7 @@ sinclude(ax_pthread.m4)
@@ -73,10 +73,10 @@ index 2b91dd3c..e6063d17 100644
  sinclude(dnscrypt/dnscrypt.m4)
  
  # must be numbers. ac_defun because of later processing
-@@ -1778,6 +1779,9 @@ case "$enable_ipset" in
- 		;;
+@@ -1819,6 +1820,9 @@ case "$enable_explicit_port_randomisation" in
  esac
  
+ 
 +# check for Fastrpz with fastrpz/rpz.m4
 +ck_FASTRPZ
 +
@@ -84,7 +84,7 @@ index 2b91dd3c..e6063d17 100644
  # on openBSD, the implicit rule make $< work.
  # on Solaris, it does not work ($? is changed sources, $^ lists dependencies).
 diff --git a/daemon/daemon.c b/daemon/daemon.c
-index 8b0fc348..7ffb9221 100644
+index 5d427925..f89f1437 100644
 --- a/daemon/daemon.c
 +++ b/daemon/daemon.c
 @@ -91,6 +91,9 @@
@@ -97,8 +97,8 @@ index 8b0fc348..7ffb9221 100644
  
  #ifdef HAVE_SYSTEMD
  #include <systemd/sd-daemon.h>
-@@ -458,6 +461,14 @@ daemon_create_workers(struct daemon* daemon)
- 		dt_apply_cfg(daemon->dtenv, daemon->cfg);
+@@ -456,6 +459,14 @@ daemon_create_workers(struct daemon* daemon)
+ 			fatal_exit("dt_create failed");
  #else
  		fatal_exit("dnstap enabled in config but not built with dnstap support");
 +#endif
@@ -112,7 +112,7 @@ index 8b0fc348..7ffb9221 100644
  #endif
  	}
  	for(i=0; i<daemon->num; i++) {
-@@ -731,6 +742,9 @@ daemon_cleanup(struct daemon* daemon)
+@@ -729,6 +740,9 @@ daemon_cleanup(struct daemon* daemon)
  #ifdef USE_DNSCRYPT
  	dnsc_delete(daemon->dnscenv);
  	daemon->dnscenv = NULL;
@@ -139,7 +139,7 @@ index 3effbafb..4d4c34da 100644
  
  /**
 diff --git a/daemon/worker.c b/daemon/worker.c
-index eb7fdf2f..1982228d 100644
+index 23e3244c..b63d49b7 100644
 --- a/daemon/worker.c
 +++ b/daemon/worker.c
 @@ -76,6 +76,9 @@
@@ -152,7 +152,7 @@ index eb7fdf2f..1982228d 100644
  #include "sldns/wire2str.h"
  #include "util/shm_side/shm_main.h"
  #include "dnscrypt/dnscrypt.h"
-@@ -534,8 +537,27 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
+@@ -535,8 +538,27 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
  			/* not secure */
  			secure = 0;
  			break;
@@ -180,7 +180,7 @@ index eb7fdf2f..1982228d 100644
  	/* return this delegation from the cache */
  	edns_bak = *edns;
  	edns->edns_version = EDNS_ADVERTISED_VERSION;
-@@ -710,6 +732,23 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
+@@ -711,6 +733,23 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
  			*is_secure_answer = 0;
  		}
  	} else *is_secure_answer = 0;
@@ -204,7 +204,7 @@ index eb7fdf2f..1982228d 100644
  
  	edns_bak = *edns;
  	edns->edns_version = EDNS_ADVERTISED_VERSION;
-@@ -1435,6 +1474,15 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
+@@ -1436,6 +1475,15 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
  		log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
  			&repinfo->addr, repinfo->addrlen);
  		goto send_reply;
@@ -220,7 +220,7 @@ index eb7fdf2f..1982228d 100644
  	}
  
  	/* If we've found a local alias, replace the qname with the alias
-@@ -1485,12 +1533,21 @@ lookup_cache:
+@@ -1486,12 +1534,21 @@ lookup_cache:
  		h = query_info_hash(lookup_qinfo, sldns_buffer_read_u16_at(c->buffer, 2));
  		if((e=slabhash_lookup(worker->env.msg_cache, h, lookup_qinfo, 0))) {
  			/* answer from cache - we have acquired a readlock on it */
@@ -244,7 +244,7 @@ index eb7fdf2f..1982228d 100644
  				/* prefetch it if the prefetch TTL expired.
  				 * Note that if there is more than one pass
  				 * its qname must be that used for cache
-@@ -1547,11 +1604,19 @@ lookup_cache:
+@@ -1548,11 +1605,19 @@ lookup_cache:
  			lock_rw_unlock(&e->lock);
  		}
  		if(!LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) {
@@ -267,10 +267,10 @@ index eb7fdf2f..1982228d 100644
  			}
  			verbose(VERB_ALGO, "answer norec from cache -- "
 diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
-index 38c2d298..3b07f392 100644
+index cd43f04e..b92a1af8 100644
 --- a/doc/unbound.conf.5.in
 +++ b/doc/unbound.conf.5.in
-@@ -1828,6 +1828,81 @@ List domain for which the AAAA records are ignored and the A record is
+@@ -1878,6 +1878,81 @@ List domain for which the AAAA records are ignored and the A record is
  used by dns64 processing instead.  Can be entered multiple times, list a
  new domain for which it applies, one per line.  Applies also to names
  underneath the name given.
@@ -2888,7 +2888,7 @@ index 00000000..21235355
 +  fi
 +])
 diff --git a/iterator/iterator.c b/iterator/iterator.c
-index 1e0113a8..2fcbf547 100644
+index 23b07ea9..c3d31a33 100644
 --- a/iterator/iterator.c
 +++ b/iterator/iterator.c
 @@ -68,6 +68,9 @@
@@ -2901,7 +2901,7 @@ index 1e0113a8..2fcbf547 100644
  
  /* in msec */
  int UNKNOWN_SERVER_NICENESS = 376;
-@@ -555,6 +558,23 @@ handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -563,6 +566,23 @@ handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq,
  		if(ntohs(r->rk.type) == LDNS_RR_TYPE_CNAME &&
  			query_dname_compare(*mname, r->rk.dname) == 0 &&
  			!iter_find_rrset_in_prepend_answer(iq, r)) {
@@ -2925,7 +2925,7 @@ index 1e0113a8..2fcbf547 100644
  			/* Add this relevant CNAME rrset to the prepend list.*/
  			if(!iter_add_prepend_answer(qstate, iq, r))
  				return 0;
-@@ -563,6 +583,9 @@ handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -571,6 +591,9 @@ handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq,
  
  		/* Other rrsets in the section are ignored. */
  	}
@@ -2935,7 +2935,7 @@ index 1e0113a8..2fcbf547 100644
  	/* add authority rrsets to authority prepend, for wildcarded CNAMEs */
  	for(i=msg->rep->an_numrrsets; i<msg->rep->an_numrrsets +
  		msg->rep->ns_numrrsets; i++) {
-@@ -1199,6 +1222,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -1231,6 +1254,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
  	uint8_t* delname;
  	size_t delnamelen;
  	struct dns_msg* msg = NULL;
@@ -2943,7 +2943,7 @@ index 1e0113a8..2fcbf547 100644
  
  	log_query_info(VERB_DETAIL, "resolving", &qstate->qinfo);
  	/* check effort */
-@@ -1285,8 +1309,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -1317,8 +1341,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
  	}
  	if(msg) {
  		/* handle positive cache response */
@@ -2953,7 +2953,7 @@ index 1e0113a8..2fcbf547 100644
  		if(verbosity >= VERB_ALGO) {
  			log_dns_msg("msg from cache lookup", &msg->qinfo, 
  				msg->rep);
-@@ -1294,7 +1317,22 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -1326,7 +1349,22 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
  				(int)msg->rep->ttl, 
  				(int)msg->rep->prefetch_ttl);
  		}
@@ -2976,7 +2976,7 @@ index 1e0113a8..2fcbf547 100644
  		if(type == RESPONSE_TYPE_CNAME) {
  			uint8_t* sname = 0;
  			size_t slen = 0;
-@@ -2718,6 +2756,62 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -2801,6 +2839,62 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
  			sock_list_insert(&qstate->reply_origin, 
  				&qstate->reply->addr, qstate->reply->addrlen, 
  				qstate->region);
@@ -3039,7 +3039,7 @@ index 1e0113a8..2fcbf547 100644
  		if(iq->minimisation_state != DONOT_MINIMISE_STATE
  			&& !(iq->chase_flags & BIT_RD)) {
  			if(FLAGS_GET_RCODE(iq->response->rep->flags) != 
-@@ -3471,12 +3565,44 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -3563,12 +3657,44 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
  		 * but only if we did recursion. The nonrecursion referral
  		 * from cache does not need to be stored in the msg cache. */
  		if(!qstate->no_cache_store && qstate->query_flags&BIT_RD) {
@@ -3085,10 +3085,10 @@ index 1e0113a8..2fcbf547 100644
  	qstate->return_msg = iq->response;
  	return 0;
 diff --git a/iterator/iterator.h b/iterator/iterator.h
-index a2f1b570..e1e4a738 100644
+index 342ac207..49b0ecdd 100644
 --- a/iterator/iterator.h
 +++ b/iterator/iterator.h
-@@ -386,6 +386,16 @@ struct iter_qstate {
+@@ -396,6 +396,16 @@ struct iter_qstate {
  	 */
  	int minimise_count;
  
@@ -3104,12 +3104,12 @@ index a2f1b570..e1e4a738 100644
 +
  	/**
  	 * Count number of time-outs. Used to prevent resolving failures when
- 	 * the QNAME minimisation QTYPE is blocked. */
+ 	 * the QNAME minimisation QTYPE is blocked. Used to determine if
 diff --git a/services/cache/dns.c b/services/cache/dns.c
-index 2a5bca4a..6de8863a 100644
+index 7b6e142c..6d7449f5 100644
 --- a/services/cache/dns.c
 +++ b/services/cache/dns.c
-@@ -967,6 +967,14 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
+@@ -969,6 +969,14 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
  	struct regional* region, uint32_t flags)
  {
  	struct reply_info* rep = NULL;
@@ -3125,7 +3125,7 @@ index 2a5bca4a..6de8863a 100644
  	rep = reply_info_copy(msgrep, env->alloc, NULL);
  	if(!rep)
 diff --git a/services/mesh.c b/services/mesh.c
-index 9114ef4c..3dc518e5 100644
+index 4b0c5db4..eb9cfa5b 100644
 --- a/services/mesh.c
 +++ b/services/mesh.c
 @@ -61,6 +61,9 @@
@@ -3138,7 +3138,7 @@ index 9114ef4c..3dc518e5 100644
  #include "respip/respip.h"
  #include "services/listen_dnsport.h"
  
-@@ -1195,6 +1198,13 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
+@@ -1207,6 +1210,13 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
  	else	secure = 0;
  	if(!rep && rcode == LDNS_RCODE_NOERROR)
  		rcode = LDNS_RCODE_SERVFAIL;
@@ -3152,7 +3152,7 @@ index 9114ef4c..3dc518e5 100644
  	/* send the reply */
  	/* We don't reuse the encoded answer if either the previous or current
  	 * response has a local alias.  We could compare the alias records
-@@ -1415,6 +1425,7 @@ struct mesh_state* mesh_area_find(struct mesh_area* mesh,
+@@ -1434,6 +1444,7 @@ struct mesh_state* mesh_area_find(struct mesh_area* mesh,
  	key.s.is_valrec = valrec;
  	key.s.qinfo = *qinfo;
  	key.s.query_flags = qflags;
@@ -3160,7 +3160,7 @@ index 9114ef4c..3dc518e5 100644
  	/* We are searching for a similar mesh state when we DO want to
  	 * aggregate the state. Thus unique is set to NULL. (default when we
  	 * desire aggregation).*/
-@@ -1461,6 +1472,10 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
+@@ -1480,6 +1491,10 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
  	if(!r)
  		return 0;
  	r->query_reply = *rep;
@@ -3172,11 +3172,11 @@ index 9114ef4c..3dc518e5 100644
  	if(edns->opt_list) {
  		r->edns.opt_list = edns_opt_copy_region(edns->opt_list,
 diff --git a/util/config_file.c b/util/config_file.c
-index 52ca5a18..0660248f 100644
+index 0e9ee471..a5fd72e0 100644
 --- a/util/config_file.c
 +++ b/util/config_file.c
-@@ -1460,6 +1460,8 @@ config_delete(struct config_file* cfg)
- 	free(cfg->dnstap_socket_path);
+@@ -1495,6 +1495,8 @@ config_delete(struct config_file* cfg)
+ 	free(cfg->dnstap_tls_client_cert_file);
  	free(cfg->dnstap_identity);
  	free(cfg->dnstap_version);
 +	if (cfg->rpz_cstr)
@@ -3185,10 +3185,10 @@ index 52ca5a18..0660248f 100644
  	config_deldblstrlist(cfg->ratelimit_below_domain);
  	config_delstrlist(cfg->python_script);
 diff --git a/util/config_file.h b/util/config_file.h
-index 8739ca2a..a2dcf215 100644
+index 66e5025d..504f4f92 100644
 --- a/util/config_file.h
 +++ b/util/config_file.h
-@@ -499,6 +499,11 @@ struct config_file {
+@@ -522,6 +522,11 @@ struct config_file {
  	/** true to disable DNSSEC lameness check in iterator */
  	int disable_dnssec_lame_check;
  
@@ -3201,10 +3201,10 @@ index 8739ca2a..a2dcf215 100644
  	int ip_ratelimit;
  	/** number of slabs for ip_ratelimit cache */
 diff --git a/util/configlexer.lex b/util/configlexer.lex
-index deedffa5..301458a3 100644
+index 83cea4b9..9a7feea4 100644
 --- a/util/configlexer.lex
 +++ b/util/configlexer.lex
-@@ -446,6 +446,10 @@ dnstap-log-forwarder-query-messages{COLON}	{
+@@ -467,6 +467,10 @@ dnstap-log-forwarder-query-messages{COLON}	{
  		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
  dnstap-log-forwarder-response-messages{COLON}	{
  		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
@@ -3216,18 +3216,18 @@ index deedffa5..301458a3 100644
  ip-ratelimit{COLON}		{ YDVAR(1, VAR_IP_RATELIMIT) }
  ratelimit{COLON}		{ YDVAR(1, VAR_RATELIMIT) }
 diff --git a/util/configparser.y b/util/configparser.y
-index d471babe..cb6b1d63 100644
+index fe600a99..ce43390f 100644
 --- a/util/configparser.y
 +++ b/util/configparser.y
-@@ -125,6 +125,7 @@ extern struct config_parser_state* cfg_parser;
+@@ -128,6 +128,7 @@ extern struct config_parser_state* cfg_parser;
  %token VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES
  %token VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES
  %token VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES
 +%token VAR_RPZ VAR_RPZ_ENABLE VAR_RPZ_ZONE VAR_RPZ_OPTION
  %token VAR_RESPONSE_IP_TAG VAR_RESPONSE_IP VAR_RESPONSE_IP_DATA
  %token VAR_HARDEN_ALGO_DOWNGRADE VAR_IP_TRANSPARENT
- %token VAR_DISABLE_DNSSEC_LAME_CHECK
-@@ -173,7 +174,7 @@ extern struct config_parser_state* cfg_parser;
+ %token VAR_IP_DSCP
+@@ -179,7 +180,7 @@ extern struct config_parser_state* cfg_parser;
  
  %%
  toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -3236,7 +3236,7 @@ index d471babe..cb6b1d63 100644
  	forwardstart contents_forward | pythonstart contents_py | 
  	rcstart contents_rc | dtstart contents_dt | viewstart contents_view |
  	dnscstart contents_dnsc | cachedbstart contents_cachedb |
-@@ -2837,6 +2838,50 @@ dt_dnstap_log_forwarder_response_messages: VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MES
+@@ -2939,6 +2940,50 @@ dt_dnstap_log_forwarder_response_messages: VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MES
  		free($2);
  	}
  	;
@@ -3384,7 +3384,7 @@ index 729877ba..ccd1a0c2 100644
  
  /**
 diff --git a/util/netevent.c b/util/netevent.c
-index 9fe5da2d..037e70d1 100644
+index 3e7a433e..f20d806f 100644
 --- a/util/netevent.c
 +++ b/util/netevent.c
 @@ -57,6 +57,9 @@
@@ -3397,7 +3397,7 @@ index 9fe5da2d..037e70d1 100644
  
  /* -------- Start of local definitions -------- */
  /** if CMSG_ALIGN is not defined on this platform, a workaround */
-@@ -590,6 +593,9 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
+@@ -596,6 +599,9 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
  	struct cmsghdr* cmsg;
  #endif /* S_SPLINT_S */
  
@@ -3407,7 +3407,7 @@ index 9fe5da2d..037e70d1 100644
  	rep.c = (struct comm_point*)arg;
  	log_assert(rep.c->type == comm_udp);
  
-@@ -679,6 +685,9 @@ comm_point_udp_callback(int fd, short event, void* arg)
+@@ -685,6 +691,9 @@ comm_point_udp_callback(int fd, short event, void* arg)
  	int i;
  	struct sldns_buffer *buffer;
  
@@ -3417,7 +3417,7 @@ index 9fe5da2d..037e70d1 100644
  	rep.c = (struct comm_point*)arg;
  	log_assert(rep.c->type == comm_udp);
  
-@@ -722,6 +731,9 @@ comm_point_udp_callback(int fd, short event, void* arg)
+@@ -728,6 +737,9 @@ comm_point_udp_callback(int fd, short event, void* arg)
  			(void)comm_point_send_udp_msg(rep.c, buffer,
  				(struct sockaddr*)&rep.addr, rep.addrlen);
  		}
@@ -3427,7 +3427,7 @@ index 9fe5da2d..037e70d1 100644
  		if(!rep.c || rep.c->fd != fd) /* commpoint closed to -1 or reused for
  		another UDP port. Note rep.c cannot be reused with TCP fd. */
  			break;
-@@ -3192,6 +3204,9 @@ comm_point_send_reply(struct comm_reply *repinfo)
+@@ -3175,6 +3187,9 @@ comm_point_send_reply(struct comm_reply *repinfo)
  				repinfo->c->tcp_timeout_msec);
  		}
  	}
@@ -3437,7 +3437,7 @@ index 9fe5da2d..037e70d1 100644
  }
  
  void 
-@@ -3201,6 +3216,9 @@ comm_point_drop_reply(struct comm_reply* repinfo)
+@@ -3184,6 +3199,9 @@ comm_point_drop_reply(struct comm_reply* repinfo)
  		return;
  	log_assert(repinfo->c);
  	log_assert(repinfo->c->type != comm_tcp_accept);
@@ -3447,7 +3447,7 @@ index 9fe5da2d..037e70d1 100644
  	if(repinfo->c->type == comm_udp)
  		return;
  	if(repinfo->c->tcp_req_info)
-@@ -3222,6 +3240,9 @@ comm_point_start_listening(struct comm_point* c, int newfd, int msec)
+@@ -3205,6 +3223,9 @@ comm_point_start_listening(struct comm_point* c, int newfd, int msec)
  {
  	verbose(VERB_ALGO, "comm point start listening %d (%d msec)", 
  		c->fd==-1?newfd:c->fd, msec);
@@ -3458,7 +3458,7 @@ index 9fe5da2d..037e70d1 100644
  		/* no use to start listening no free slots. */
  		return;
 diff --git a/util/netevent.h b/util/netevent.h
-index d80c72b3..0233292f 100644
+index bb2cd1e5..666067e8 100644
 --- a/util/netevent.h
 +++ b/util/netevent.h
 @@ -120,6 +120,10 @@ struct comm_reply {
diff --git a/contrib/unbound.service.in b/contrib/unbound.service.in
index 8ebe529c9..c95ab94b3 100644
--- a/contrib/unbound.service.in
+++ b/contrib/unbound.service.in
@@ -42,9 +42,9 @@
 [Unit]
 Description=Validating, recursive, and caching DNS resolver
 Documentation=man:unbound(8)
-After=network.target
-Before=network-online.target nss-lookup.target
-Wants=nss-lookup.target
+After=network-online.target
+Before=nss-lookup.target
+Wants=network-online.target nss-lookup.target
 
 [Install]
 WantedBy=multi-user.target
diff --git a/contrib/unbound_munin_ b/contrib/unbound_munin_
index 2839cd8b5..defca291c 100755
--- a/contrib/unbound_munin_
+++ b/contrib/unbound_munin_
@@ -174,11 +174,11 @@ get_state ( ) {
 if test "$1" = "autoconf" ; then
 	if test ! -f $conf; then
 		echo no "($conf does not exist)"
-		exit 1
+		exit 0
 	fi
 	if test ! -d `dirname $state`; then
 		echo no "(`dirname $state` directory does not exist)"
-		exit 1
+		exit 0
 	fi
 	echo yes
 	exit 0
diff --git a/daemon/acl_list.c b/daemon/acl_list.c
index c16a920d9..84324575e 100644
--- a/daemon/acl_list.c
+++ b/daemon/acl_list.c
@@ -273,7 +273,7 @@ check_data(const char* data, const struct config_strlist* head)
 	if(res == 0)
 		return 1;
 	log_err("rr data [char %d] parse error %s",
-		(int)LDNS_WIREPARSE_OFFSET(res)-13,
+		(int)LDNS_WIREPARSE_OFFSET(res)-2,
 		sldns_get_errorstr_parse(res));
 	return 0;
 }
diff --git a/daemon/daemon.c b/daemon/daemon.c
index 5d4279259..f480c94e6 100644
--- a/daemon/daemon.c
+++ b/daemon/daemon.c
@@ -77,6 +77,7 @@
 #include "util/storage/lookup3.h"
 #include "util/storage/slabhash.h"
 #include "util/tcp_conn_limit.h"
+#include "util/edns.h"
 #include "services/listen_dnsport.h"
 #include "services/cache/rrset.h"
 #include "services/cache/infra.h"
@@ -290,6 +291,15 @@ daemon_init(void)
 		free(daemon);
 		return NULL;
 	}
+	if(!(daemon->env->edns_tags = edns_tags_create())) {
+		auth_zones_delete(daemon->env->auth_zones);
+		acl_list_delete(daemon->acl);
+		tcl_list_delete(daemon->tcl);
+		edns_known_options_delete(daemon->env);
+		free(daemon->env);
+		free(daemon);
+		return NULL;
+	}
 	return daemon;	
 }
 
@@ -298,6 +308,8 @@ daemon_open_shared_ports(struct daemon* daemon)
 {
 	log_assert(daemon);
 	if(daemon->cfg->port != daemon->listening_port) {
+		char** resif = NULL;
+		int num_resif = 0;
 		size_t i;
 		struct listen_port* p0;
 		daemon->reuseport = 0;
@@ -308,15 +320,18 @@ daemon_open_shared_ports(struct daemon* daemon)
 			free(daemon->ports);
 			daemon->ports = NULL;
 		}
+		if(!resolve_interface_names(daemon->cfg, &resif, &num_resif))
+			return 0;
 		/* see if we want to reuseport */
 #ifdef SO_REUSEPORT
 		if(daemon->cfg->so_reuseport && daemon->cfg->num_threads > 0)
 			daemon->reuseport = 1;
 #endif
 		/* try to use reuseport */
-		p0 = listening_ports_open(daemon->cfg, &daemon->reuseport);
+		p0 = listening_ports_open(daemon->cfg, resif, num_resif, &daemon->reuseport);
 		if(!p0) {
 			listening_ports_free(p0);
+			config_del_strarray(resif, num_resif);
 			return 0;
 		}
 		if(daemon->reuseport) {
@@ -330,6 +345,7 @@ daemon_open_shared_ports(struct daemon* daemon)
 		if(!(daemon->ports = (struct listen_port**)calloc(
 			daemon->num_ports, sizeof(*daemon->ports)))) {
 			listening_ports_free(p0);
+			config_del_strarray(resif, num_resif);
 			return 0;
 		}
 		daemon->ports[0] = p0;
@@ -338,16 +354,19 @@ daemon_open_shared_ports(struct daemon* daemon)
 			for(i=1; i<daemon->num_ports; i++) {
 				if(!(daemon->ports[i]=
 					listening_ports_open(daemon->cfg,
+						resif, num_resif,
 						&daemon->reuseport))
 					|| !daemon->reuseport ) {
 					for(i=0; i<daemon->num_ports; i++)
 						listening_ports_free(daemon->ports[i]);
 					free(daemon->ports);
 					daemon->ports = NULL;
+					config_del_strarray(resif, num_resif);
 					return 0;
 				}
 			}
 		}
+		config_del_strarray(resif, num_resif);
 		daemon->listening_port = daemon->cfg->port;
 	}
 	if(!daemon->cfg->remote_control_enable && daemon->rc_port) {
@@ -619,6 +638,10 @@ daemon_fork(struct daemon* daemon)
 		&daemon->use_rpz))
 		fatal_exit("auth_zones could not be setup");
 
+	/* Set-up EDNS tags */
+	if(!edns_tags_apply_cfg(daemon->env->edns_tags, daemon->cfg))
+		fatal_exit("Could not set up EDNS tags");
+
 	/* setup modules */
 	daemon_setup_modules(daemon);
 
@@ -750,6 +773,7 @@ daemon_delete(struct daemon* daemon)
 		rrset_cache_delete(daemon->env->rrset_cache);
 		infra_delete(daemon->env->infra_cache);
 		edns_known_options_delete(daemon->env);
+		edns_tags_delete(daemon->env->edns_tags);
 		auth_zones_delete(daemon->env->auth_zones);
 	}
 	ub_randfree(daemon->rand);
diff --git a/daemon/remote.c b/daemon/remote.c
index 485f6031b..8324e1901 100644
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -349,11 +349,7 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
 	/* alloc */
 	n = (struct listen_port*)calloc(1, sizeof(*n));
 	if(!n) {
-#ifndef USE_WINSOCK
-		close(fd);
-#else
-		closesocket(fd);
-#endif
+		sock_close(fd);
 		log_err("out of memory");
 		return 0;
 	}
@@ -462,11 +458,7 @@ int remote_accept_callback(struct comm_point* c, void* arg, int err,
 	if(rc->active >= rc->max_active) {
 		log_warn("drop incoming remote control: too many connections");
 	close_exit:
-#ifndef USE_WINSOCK
-		close(newfd);
-#else
-		closesocket(newfd);
-#endif
+		sock_close(newfd);
 		return 0;
 	}
 
@@ -575,11 +567,8 @@ ssl_print_text(RES* res, const char* text)
 			if(r == -1) {
 				if(errno == EAGAIN || errno == EINTR)
 					continue;
-#ifndef USE_WINSOCK
-				log_err("could not send: %s", strerror(errno));
-#else
-				log_err("could not send: %s", wsa_strerror(WSAGetLastError()));
-#endif
+				log_err("could not send: %s",
+					sock_strerror(errno));
 				return 0;
 			}
 			at += r;
@@ -636,11 +625,8 @@ ssl_read_line(RES* res, char* buf, size_t max)
 					}
 					if(errno == EINTR || errno == EAGAIN)
 						continue;
-#ifndef USE_WINSOCK
-					log_err("could not recv: %s", strerror(errno));
-#else
-					log_err("could not recv: %s", wsa_strerror(WSAGetLastError()));
-#endif
+					log_err("could not recv: %s",
+						sock_strerror(errno));
 					return 0;
 				}
 				break;
@@ -3125,11 +3111,7 @@ handle_req(struct daemon_remote* rc, struct rc_state* s, RES* res)
 				if(rr == 0) return;
 				if(errno == EINTR || errno == EAGAIN)
 					continue;
-#ifndef USE_WINSOCK
-				log_err("could not recv: %s", strerror(errno));
-#else
-				log_err("could not recv: %s", wsa_strerror(WSAGetLastError()));
-#endif
+				log_err("could not recv: %s", sock_strerror(errno));
 				return;
 			}
 			r = (int)rr;
diff --git a/daemon/stats.c b/daemon/stats.c
index bb7b4232f..8720a52d6 100644
--- a/daemon/stats.c
+++ b/daemon/stats.c
@@ -271,6 +271,7 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 	s->svr.ans_secure += (long long)worker->env.mesh->ans_secure;
 	s->svr.ans_bogus += (long long)worker->env.mesh->ans_bogus;
 	s->svr.ans_rcode_nodata += (long long)worker->env.mesh->ans_nodata;
+	s->svr.ans_expired += (long long)worker->env.mesh->ans_expired;
 	for(i=0; i<UB_STATS_RCODE_NUM; i++)
 		s->svr.ans_rcode[i] += (long long)worker->env.mesh->ans_rcode[i];
 	for(i=0; i<UB_STATS_RPZ_ACTION_NUM; i++)
diff --git a/daemon/unbound.c b/daemon/unbound.c
index ceb3da6f5..cd0fd69f2 100644
--- a/daemon/unbound.c
+++ b/daemon/unbound.c
@@ -92,7 +92,7 @@
 #include <TargetConditionals.h>
 #endif
 
-#if defined(TARGET_OS_TV) || defined(TARGET_OS_WATCH)
+#if (defined(TARGET_OS_TV) && TARGET_OS_TV) || (defined(TARGET_OS_WATCH) && TARGET_OS_WATCH)
 #undef HAVE_FORK
 #endif
 
@@ -534,6 +534,8 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 			LOGIN_SETALL & ~LOGIN_SETUSER & ~LOGIN_SETGROUP) != 0)
 			log_warn("unable to setusercontext %s: %s",
 				cfg->username, strerror(errno));
+#else
+		(void)pwd;
 #endif /* HAVE_SETUSERCONTEXT */
 	}
 #endif /* HAVE_GETPWNAM */
diff --git a/daemon/worker.c b/daemon/worker.c
index e1d64bceb..695a4cfe5 100644
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -1219,7 +1219,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
 		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), 
 			LDNS_RCODE_FORMERR);
-		server_stats_insrcode(&worker->stats, c->buffer);
 		goto send_reply;
 	}
 	if(worker->env.cfg->log_queries) {
@@ -1237,7 +1236,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			LDNS_RCODE_REFUSED);
 		if(worker->stats.extended) {
 			worker->stats.qtype[qinfo.qtype]++;
-			server_stats_insrcode(&worker->stats, c->buffer);
 		}
 		goto send_reply;
 	}
@@ -1259,7 +1257,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			LDNS_RCODE_FORMERR);
 		if(worker->stats.extended) {
 			worker->stats.qtype[qinfo.qtype]++;
-			server_stats_insrcode(&worker->stats, c->buffer);
 		}
 		goto send_reply;
 	}
@@ -1275,7 +1272,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 			sldns_buffer_read_u16_at(c->buffer, 2), &reply_edns);
 		regional_free_all(worker->scratchpad);
-		server_stats_insrcode(&worker->stats, c->buffer);
 		goto send_reply;
 	}
 	if(edns.edns_present) {
@@ -1354,7 +1350,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		edns.udp_size = 65535; /* max size for TCP replies */
 	if(qinfo.qclass == LDNS_RR_CLASS_CH && answer_chaos(worker, &qinfo,
 		&edns, repinfo, c->buffer)) {
-		server_stats_insrcode(&worker->stats, c->buffer);
 		regional_free_all(worker->scratchpad);
 		goto send_reply;
 	}
@@ -1375,7 +1370,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
-		server_stats_insrcode(&worker->stats, c->buffer);
 		goto send_reply;
 	}
 	if(worker->env.auth_zones &&
@@ -1387,7 +1381,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
-		server_stats_insrcode(&worker->stats, c->buffer);
 		goto send_reply;
 	}
 	if(worker->env.auth_zones &&
@@ -1403,7 +1396,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		if(LDNS_RD_WIRE(sldns_buffer_begin(c->buffer)) &&
 		   acl != acl_deny_non_local && acl != acl_refuse_non_local)
 			LDNS_RA_SET(sldns_buffer_begin(c->buffer));
-		server_stats_insrcode(&worker->stats, c->buffer);
 		goto send_reply;
 	}
 
@@ -1432,7 +1424,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 			sldns_buffer_read_u16_at(c->buffer, 2), NULL);
 		regional_free_all(worker->scratchpad);
-		server_stats_insrcode(&worker->stats, c->buffer);
 		log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
 			&repinfo->addr, repinfo->addrlen);
 		goto send_reply;
@@ -1588,9 +1579,9 @@ send_reply_rc:
 	if(is_expired_answer) {
 		worker->stats.ans_expired++;
 	}
+	server_stats_insrcode(&worker->stats, c->buffer);
 	if(worker->stats.extended) {
 		if(is_secure_answer) worker->stats.ans_secure++;
-		server_stats_insrcode(&worker->stats, repinfo->c->buffer);
 	}
 #ifdef USE_DNSTAP
 	if(worker->dtenv.log_client_response_messages)
diff --git a/dnstap/dnstap.c b/dnstap/dnstap.c
index cc5449dff..bda837876 100644
--- a/dnstap/dnstap.c
+++ b/dnstap/dnstap.c
@@ -134,9 +134,15 @@ dt_create(struct config_file* cfg)
 
 	if(cfg->dnstap && cfg->dnstap_socket_path && cfg->dnstap_socket_path[0] &&
 		(cfg->dnstap_ip==NULL || cfg->dnstap_ip[0]==0)) {
+		char* p = fname_after_chroot(cfg->dnstap_socket_path, cfg, 1);
+		if(!p) {
+			log_err("malloc failure");
+			return NULL;
+		}
 		verbose(VERB_OPS, "attempting to connect to dnstap socket %s",
-			cfg->dnstap_socket_path);
-		check_socket_file(cfg->dnstap_socket_path);
+			p);
+		check_socket_file(p);
+		free(p);
 	}
 
 	env = (struct dt_env *) calloc(1, sizeof(struct dt_env));
diff --git a/dnstap/dnstap_fstrm.c b/dnstap/dnstap_fstrm.c
index cce16e2e4..289e78bdf 100644
--- a/dnstap/dnstap_fstrm.c
+++ b/dnstap/dnstap_fstrm.c
@@ -92,6 +92,34 @@ void* fstrm_create_control_frame_stop(size_t* len)
 	return control;
 }
 
+void* fstrm_create_control_frame_ready(char* contenttype, size_t* len)
+{
+	uint32_t* control;
+	size_t n;
+	/* start bidirectional stream:
+	 * 4 bytes 0 escape
+	 * 4 bytes bigendian length of frame
+	 * 4 bytes bigendian type READY
+	 * 4 bytes bigendian frame option content type
+	 * 4 bytes bigendian length of string
+	 * string of content type.
+	 */
+	/* len includes the escape and framelength */
+	n = 4+4+4+4+4+strlen(contenttype);
+	control = malloc(n);
+	if(!control) {
+		return NULL;
+	}
+	control[0] = 0;
+	control[1] = htonl(4+4+4+strlen(contenttype));
+	control[2] = htonl(FSTRM_CONTROL_FRAME_READY);
+	control[3] = htonl(FSTRM_CONTROL_FIELD_TYPE_CONTENT_TYPE);
+	control[4] = htonl(strlen(contenttype));
+	memmove(&control[5], contenttype, strlen(contenttype));
+	*len = n;
+	return control;
+}
+
 void* fstrm_create_control_frame_accept(char* contenttype, size_t* len)
 {
 	uint32_t* control;
diff --git a/dnstap/dnstap_fstrm.h b/dnstap/dnstap_fstrm.h
index f0cf93628..8b37d5f9e 100644
--- a/dnstap/dnstap_fstrm.h
+++ b/dnstap/dnstap_fstrm.h
@@ -127,6 +127,21 @@
  */
 void* fstrm_create_control_frame_start(char* contenttype, size_t* len);
 
+/**
+ * This creates an FSTRM control frame of type READY.
+ * @param contenttype: a zero delimited string with the content type.
+ * 	eg. use the constant DNSTAP_CONTENT_TYPE, which is defined as
+ * 	"protobuf:dnstap.Dnstap", for a dnstap frame stream.
+ * @param len: if a buffer is returned this is the length of that buffer.
+ * @return NULL on malloc failure.  Returns a malloced buffer with the
+ * protocol message.  The buffer starts with the 4 bytes of 0 that indicate
+ * a control frame.  The buffer should be sent without preceding it with
+ * the 'len' variable (like data frames are), but straight the content of the
+ * buffer, because the lengths are included in the buffer.  This is so that
+ * the zero control indicator can be included before the control frame length.
+ */
+void* fstrm_create_control_frame_ready(char* contenttype, size_t* len);
+
 /**
  * This creates an FSTRM control frame of type STOP.
  * @param len: if a buffer is returned this is the length of that buffer.
diff --git a/dnstap/dtstream.c b/dnstap/dtstream.c
index 4081a6372..a778bb64b 100644
--- a/dnstap/dtstream.c
+++ b/dnstap/dtstream.c
@@ -48,6 +48,7 @@
 #include "util/ub_event.h"
 #include "util/net_help.h"
 #include "services/outside_network.h"
+#include "sldns/sbuffer.h"
 #ifdef HAVE_SYS_UN_H
 #include <sys/un.h>
 #endif
@@ -68,6 +69,9 @@
 /** the msec to wait for reconnect slow, to stop busy spinning on reconnect */
 #define DTIO_RECONNECT_TIMEOUT_SLOW 1000
 
+/** maximum length of received frame */
+#define DTIO_RECV_FRAME_MAX_LEN 1000
+
 struct stop_flush_info;
 /** DTIO command channel commands */
 enum {
@@ -85,9 +89,13 @@ static int dtio_add_output_event_write(struct dt_io_thread* dtio);
 static void dtio_reconnect_enable(struct dt_io_thread* dtio);
 /** stop from stop_flush event loop */
 static void dtio_stop_flush_exit(struct stop_flush_info* info);
+/** setup a start control message */
+static int dtio_control_start_send(struct dt_io_thread* dtio);
 #ifdef HAVE_SSL
 /** enable briefly waiting for a read event, for SSL negotiation */
 static int dtio_enable_brief_read(struct dt_io_thread* dtio);
+/** enable briefly waiting for a write event, for SSL negotiation */
+static int dtio_enable_brief_write(struct dt_io_thread* dtio);
 #endif
 
 struct dt_msg_queue*
@@ -141,15 +149,14 @@ static void dtio_wakeup(struct dt_io_thread* dtio)
 #ifndef USE_WINSOCK
 			if(errno == EINTR || errno == EAGAIN)
 				continue;
-			log_err("dnstap io wakeup: write: %s", strerror(errno));
 #else
 			if(WSAGetLastError() == WSAEINPROGRESS)
 				continue;
 			if(WSAGetLastError() == WSAEWOULDBLOCK)
 				continue;
-			log_err("dnstap io stop: write: %s",
-				wsa_strerror(WSAGetLastError()));
 #endif
+			log_err("dnstap io wakeup: write: %s",
+				sock_strerror(errno));
 			break;
 		}
 		break;
@@ -261,6 +268,7 @@ int dt_io_thread_apply_cfg(struct dt_io_thread* dtio, struct config_file *cfg)
 	} else {
 		dtio->upstream_is_unix = 1;
 	}
+	dtio->is_bidirectional = cfg->dnstap_bidirectional;
 
 	if(dtio->upstream_is_unix) {
 		if(!cfg->dnstap_socket_path ||
@@ -270,7 +278,8 @@ int dt_io_thread_apply_cfg(struct dt_io_thread* dtio, struct config_file *cfg)
 			return 0;
 		}
 		free(dtio->socket_path);
-		dtio->socket_path = strdup(cfg->dnstap_socket_path);
+		dtio->socket_path = fname_after_chroot(cfg->dnstap_socket_path,
+			cfg, 1);
 		if(!dtio->socket_path) {
 			log_err("dnstap setup: malloc failure");
 			return 0;
@@ -551,6 +560,20 @@ static void dtio_cur_msg_free(struct dt_io_thread* dtio)
 	dtio->cur_msg_len_done = 0;
 }
 
+/** delete the buffer and counters used to read frame */
+static void dtio_read_frame_free(struct dt_frame_read_buf* rb)
+{
+	if(rb->buf) {
+		free(rb->buf);
+		rb->buf = NULL;
+	}
+	rb->buf_count = 0;
+	rb->buf_cap = 0;
+	rb->frame_len = 0;
+	rb->frame_len_done = 0;
+	rb->control_frame = 0;
+}
+
 /** del the output file descriptor event for listening */
 static void dtio_del_output_event(struct dt_io_thread* dtio)
 {
@@ -564,11 +587,7 @@ static void dtio_del_output_event(struct dt_io_thread* dtio)
 /** close dtio socket and set it to -1 */
 static void dtio_close_fd(struct dt_io_thread* dtio)
 {
-#ifndef USE_WINSOCK
-	close(dtio->fd);
-#else
-	closesocket(dtio->fd);
-#endif
+	sock_close(dtio->fd);
 	dtio->fd = -1;
 }
 
@@ -594,6 +613,11 @@ static void dtio_close_output(struct dt_io_thread* dtio)
 	if(dtio->cur_msg) {
 		dtio_cur_msg_free(dtio);
 	}
+
+	dtio->ready_frame_sent = 0;
+	dtio->accept_frame_received = 0;
+	dtio_read_frame_free(&dtio->read_frame);
+
 	dtio_reconnect_enable(dtio);
 }
 
@@ -631,13 +655,8 @@ static int dtio_check_nb_connect(struct dt_io_thread* dtio)
 		char* to = dtio->socket_path;
 		if(!to) to = dtio->ip_str;
 		if(!to) to = "";
-#ifndef USE_WINSOCK
 		log_err("dnstap io: failed to connect to \"%s\": %s",
-			to, strerror(error));
-#else
-		log_err("dnstap io: failed to connect to \"%s\": %s",
-			to, wsa_strerror(error));
-#endif
+			to, sock_strerror(error));
 		return -1; /* error, close it */
 	}
 
@@ -714,7 +733,6 @@ static int dtio_write_buf(struct dt_io_thread* dtio, uint8_t* buf,
 #ifndef USE_WINSOCK
 		if(errno == EINTR || errno == EAGAIN)
 			return 0;
-		log_err("dnstap io: failed send: %s", strerror(errno));
 #else
 		if(WSAGetLastError() == WSAEINPROGRESS)
 			return 0;
@@ -724,9 +742,8 @@ static int dtio_write_buf(struct dt_io_thread* dtio, uint8_t* buf,
 				UB_EV_WRITE);
 			return 0;
 		}
-		log_err("dnstap io: failed send: %s",
-			wsa_strerror(WSAGetLastError()));
 #endif
+		log_err("dnstap io: failed send: %s", sock_strerror(errno));
 		return -1;
 	}
 	return ret;
@@ -750,7 +767,6 @@ static int dtio_write_with_writev(struct dt_io_thread* dtio)
 #ifndef USE_WINSOCK
 		if(errno == EINTR || errno == EAGAIN)
 			return 0;
-		log_err("dnstap io: failed writev: %s", strerror(errno));
 #else
 		if(WSAGetLastError() == WSAEINPROGRESS)
 			return 0;
@@ -760,9 +776,8 @@ static int dtio_write_with_writev(struct dt_io_thread* dtio)
 				UB_EV_WRITE);
 			return 0;
 		}
-		log_err("dnstap io: failed writev: %s",
-			wsa_strerror(WSAGetLastError()));
 #endif
+		log_err("dnstap io: failed writev: %s", sock_strerror(errno));
 		/* close the channel */
 		dtio_del_output_event(dtio);
 		dtio_close_output(dtio);
@@ -855,6 +870,94 @@ static int dtio_write_more(struct dt_io_thread* dtio)
 	return 1;
 }
 
+/** Receive bytes from dtio->fd, store in buffer. Returns 0: closed,
+ * -1: continue, >0: number of bytes read into buffer */
+static ssize_t receive_bytes(struct dt_io_thread* dtio, void* buf, size_t len) {
+	ssize_t r;
+	r = recv(dtio->fd, (void*)buf, len, 0);
+	if(r == -1) {
+		char* to = dtio->socket_path;
+		if(!to) to = dtio->ip_str;
+		if(!to) to = "";
+#ifndef USE_WINSOCK
+		if(errno == EINTR || errno == EAGAIN)
+			return -1; /* try later */
+#else
+		if(WSAGetLastError() == WSAEINPROGRESS) {
+			return -1; /* try later */
+		} else if(WSAGetLastError() == WSAEWOULDBLOCK) {
+			ub_winsock_tcp_wouldblock(
+				(dtio->stop_flush_event?
+				dtio->stop_flush_event:dtio->event),
+				UB_EV_READ);
+			return -1; /* try later */
+		}
+#endif
+		if(dtio->reconnect_timeout > DTIO_RECONNECT_TIMEOUT_MIN &&
+			verbosity < 4)
+			return 0; /* no log retries on low verbosity */
+		log_err("dnstap io: output closed, recv %s: %s", to,
+			strerror(errno));
+		/* and close below */
+		return 0;
+	}
+	if(r == 0) {
+		if(dtio->reconnect_timeout > DTIO_RECONNECT_TIMEOUT_MIN &&
+			verbosity < 4)
+			return 0; /* no log retries on low verbosity */
+		verbose(VERB_DETAIL, "dnstap io: output closed by the other side");
+		/* and close below */
+		return 0;
+	}
+	/* something was received */
+	return r;
+}
+
+#ifdef HAVE_SSL
+/** Receive bytes over TLS from dtio->fd, store in buffer. Returns 0: closed,
+ * -1: continue, >0: number of bytes read into buffer */
+static int ssl_read_bytes(struct dt_io_thread* dtio, void* buf, size_t len)
+{
+	int r;
+	ERR_clear_error();
+	r = SSL_read(dtio->ssl, buf, len);
+	if(r <= 0) {
+		int want = SSL_get_error(dtio->ssl, r);
+		if(want == SSL_ERROR_ZERO_RETURN) {
+			if(dtio->reconnect_timeout > DTIO_RECONNECT_TIMEOUT_MIN &&
+				verbosity < 4)
+				return 0; /* no log retries on low verbosity */
+			verbose(VERB_DETAIL, "dnstap io: output closed by the "
+				"other side");
+			return 0;
+		} else if(want == SSL_ERROR_WANT_READ) {
+			/* continue later */
+			return -1;
+		} else if(want == SSL_ERROR_WANT_WRITE) {
+			(void)dtio_enable_brief_write(dtio);
+			return -1;
+		} else if(want == SSL_ERROR_SYSCALL) {
+#ifdef ECONNRESET
+			if(dtio->reconnect_timeout > DTIO_RECONNECT_TIMEOUT_MIN &&
+				errno == ECONNRESET && verbosity < 4)
+				return 0; /* silence reset by peer */
+#endif
+			if(errno != 0)
+				log_err("SSL_read syscall: %s",
+					strerror(errno));
+			verbose(VERB_DETAIL, "dnstap io: output closed by the "
+				"other side");
+			return 0;
+		}
+		log_crypto_err("could not SSL_read");
+		verbose(VERB_DETAIL, "dnstap io: output closed by the "
+				"other side");
+		return 0;
+	}
+	return r;
+}
+#endif /* HAVE_SSL */
+
 /** check if the output fd has been closed,
  * it returns false if the stream is closed. */
 static int dtio_check_close(struct dt_io_thread* dtio)
@@ -864,44 +967,17 @@ static int dtio_check_close(struct dt_io_thread* dtio)
 	 * packets is okay for the framestream protocol.  And also, the
 	 * read call can return that the stream has been closed by the
 	 * other side. */
-	ssize_t r;
 	uint8_t buf[1024];
+	int r = -1;
+
+
 	if(dtio->fd == -1) return 0;
-	while(1) {
-		r = recv(dtio->fd, (void*)buf, sizeof(buf), 0);
-		if(r == -1) {
-			char* to = dtio->socket_path;
-			if(!to) to = dtio->ip_str;
-			if(!to) to = "";
-#ifndef USE_WINSOCK
-			if(errno == EINTR || errno == EAGAIN)
-				return 1; /* try later */
-#else
-			if(WSAGetLastError() == WSAEINPROGRESS) {
-				return 1; /* try later */
-			} else if(WSAGetLastError() == WSAEWOULDBLOCK) {
-				ub_winsock_tcp_wouldblock(
-					(dtio->stop_flush_event?
-					dtio->stop_flush_event:dtio->event),
-					UB_EV_READ);
-				return 1; /* try later */
-			}
-#endif
-			if(dtio->reconnect_timeout > DTIO_RECONNECT_TIMEOUT_MIN && verbosity < 4)
-				break; /* no log retries on low verbosity */
-			log_err("dnstap io: output closed, recv %s: %s", to,
-				strerror(errno));
-			/* and close below */
-			break;
-		}
-		if(r == 0) {
-			if(dtio->reconnect_timeout > DTIO_RECONNECT_TIMEOUT_MIN && verbosity < 4)
-				break; /* no log retries on low verbosity */
-			verbose(VERB_DETAIL, "dnstap io: output closed by the other side");
-			/* and close below */
-			break;
-		}
-		/* something was received, ignore it */
+
+	while(r != 0) {
+		/* not interested in buffer content, overwrite */
+		r = receive_bytes(dtio, (void*)buf, sizeof(buf));
+		if(r == -1)
+			return 1;
 	}
 	/* the other end has been closed */
 	/* close the channel */
@@ -910,6 +986,143 @@ static int dtio_check_close(struct dt_io_thread* dtio)
 	return 0;
 }
 
+/** Read accept frame. Returns -1: continue reading, 0: closed,
+ * 1: valid accept received. */
+static int dtio_read_accept_frame(struct dt_io_thread* dtio)
+{
+	int r;
+	size_t read_frame_done;
+	while(dtio->read_frame.frame_len_done < 4) {
+#ifdef HAVE_SSL
+		if(dtio->ssl) {
+			r = ssl_read_bytes(dtio,
+				(uint8_t*)&dtio->read_frame.frame_len+
+				dtio->read_frame.frame_len_done,
+				4-dtio->read_frame.frame_len_done);
+		} else {
+#endif
+			r = receive_bytes(dtio,
+				(uint8_t*)&dtio->read_frame.frame_len+
+				dtio->read_frame.frame_len_done,
+				4-dtio->read_frame.frame_len_done);
+#ifdef HAVE_SSL
+		}
+#endif
+		if(r == -1)
+			return -1; /* continue reading */
+		if(r == 0) {
+			 /* connection closed */
+			goto close_connection;
+		}
+		dtio->read_frame.frame_len_done += r;
+		if(dtio->read_frame.frame_len_done < 4)
+			return -1; /* continue reading */
+
+		if(dtio->read_frame.frame_len == 0) {
+			dtio->read_frame.frame_len_done = 0;
+			dtio->read_frame.control_frame = 1;
+			continue;
+		}
+		dtio->read_frame.frame_len = ntohl(dtio->read_frame.frame_len);
+		if(dtio->read_frame.frame_len > DTIO_RECV_FRAME_MAX_LEN) {
+			verbose(VERB_OPS, "dnstap: received frame exceeds max "
+				"length of %d bytes, closing connection",
+				DTIO_RECV_FRAME_MAX_LEN);
+			goto close_connection;
+		}
+		dtio->read_frame.buf = calloc(1, dtio->read_frame.frame_len);
+		dtio->read_frame.buf_cap = dtio->read_frame.frame_len;
+		if(!dtio->read_frame.buf) {
+			log_err("dnstap io: out of memory (creating read "
+				"buffer)");
+			goto close_connection;
+		}
+	}
+	if(dtio->read_frame.buf_count < dtio->read_frame.frame_len) {
+#ifdef HAVE_SSL
+		if(dtio->ssl) {
+			r = ssl_read_bytes(dtio, dtio->read_frame.buf+
+				dtio->read_frame.buf_count,
+				dtio->read_frame.buf_cap-
+				dtio->read_frame.buf_count);
+		} else {
+#endif
+			r = receive_bytes(dtio, dtio->read_frame.buf+
+				dtio->read_frame.buf_count,
+				dtio->read_frame.buf_cap-
+				dtio->read_frame.buf_count);
+#ifdef HAVE_SSL
+		}
+#endif
+		if(r == -1)
+			return -1; /* continue reading */
+		if(r == 0) {
+			 /* connection closed */
+			goto close_connection;
+		}
+		dtio->read_frame.buf_count += r;
+		if(dtio->read_frame.buf_count < dtio->read_frame.frame_len)
+			return -1; /* continue reading */
+	}
+
+	/* Complete frame received, check if this is a valid ACCEPT control
+	 * frame. */
+	if(dtio->read_frame.frame_len < 4) {
+		verbose(VERB_OPS, "dnstap: invalid data received");
+		goto close_connection;
+	}
+	if(sldns_read_uint32(dtio->read_frame.buf) !=
+		FSTRM_CONTROL_FRAME_ACCEPT) {
+		verbose(VERB_ALGO, "dnstap: invalid control type received, "
+			"ignored");
+		dtio->ready_frame_sent = 0;
+		dtio->accept_frame_received = 0;
+		dtio_read_frame_free(&dtio->read_frame);
+		return -1;
+	}
+	read_frame_done = 4; /* control frame type */
+
+	/* Iterate over control fields, ignore unknown types.
+	 * Need to be able to read at least 8 bytes (control field type +
+	 * length). */
+	while(read_frame_done+8 < dtio->read_frame.frame_len) {
+		uint32_t type = sldns_read_uint32(dtio->read_frame.buf +
+			read_frame_done);
+		uint32_t len = sldns_read_uint32(dtio->read_frame.buf +
+			read_frame_done + 4);
+		if(type == FSTRM_CONTROL_FIELD_TYPE_CONTENT_TYPE) {
+			if(len == strlen(DNSTAP_CONTENT_TYPE) &&
+				read_frame_done+8+len <=
+				dtio->read_frame.frame_len &&
+				memcmp(dtio->read_frame.buf + read_frame_done +
+					+ 8, DNSTAP_CONTENT_TYPE, len) == 0) {
+				if(!dtio_control_start_send(dtio)) {
+					verbose(VERB_OPS, "dnstap io: out of "
+					 "memory while sending START frame");
+					goto close_connection;
+				}
+				dtio->accept_frame_received = 1;
+				return 1;
+			} else {
+				/* unknow content type */
+				verbose(VERB_ALGO, "dnstap: ACCEPT frame "
+					"contains unknown content type, "
+					"closing connection");
+				goto close_connection;
+			}
+		}
+		/* unknown option, try next */
+		read_frame_done += 8+len;
+	}
+
+
+close_connection:
+	dtio_del_output_event(dtio);
+	dtio_reconnect_slow(dtio, DTIO_RECONNECT_TIMEOUT_SLOW);
+	dtio_close_output(dtio);
+	return 0;
+}
+
 /** add the output file descriptor event for listening, read only */
 static int dtio_add_output_event_read(struct dt_io_thread* dtio)
 {
@@ -1002,6 +1215,24 @@ static int dtio_disable_brief_read(struct dt_io_thread* dtio)
 }
 #endif /* HAVE_SSL */
 
+#ifdef HAVE_SSL
+/** enable the brief write condition */
+static int dtio_enable_brief_write(struct dt_io_thread* dtio)
+{
+	dtio->ssl_brief_write = 1;
+	return dtio_add_output_event_write(dtio);
+}
+#endif /* HAVE_SSL */
+
+#ifdef HAVE_SSL
+/** disable the brief write condition */
+static int dtio_disable_brief_write(struct dt_io_thread* dtio)
+{
+	dtio->ssl_brief_write = 0;
+	return dtio_add_output_event_read(dtio);
+}
+#endif /* HAVE_SSL */
+
 #ifdef HAVE_SSL
 /** check peer verification after ssl handshake connection, false if closed*/
 static int dtio_ssl_check_peer(struct dt_io_thread* dtio)
@@ -1175,8 +1406,13 @@ void dtio_output_cb(int ATTR_UNUSED(fd), short bits, void* arg)
 	}
 #endif
 
-	if((bits&UB_EV_READ)) {
-		if(!dtio_check_close(dtio))
+	if((bits&UB_EV_READ || dtio->ssl_brief_write)) {
+		if(dtio->ssl_brief_write)
+			(void)dtio_disable_brief_write(dtio);
+		if(dtio->ready_frame_sent && !dtio->accept_frame_received) {
+			if(dtio_read_accept_frame(dtio) <= 0)
+				return;
+		} else if(!dtio_check_close(dtio))
 			return;
 	}
 
@@ -1208,6 +1444,15 @@ void dtio_output_cb(int ATTR_UNUSED(fd), short bits, void* arg)
 
 		/* done with the current message */
 		dtio_cur_msg_free(dtio);
+
+		/* If this is a bidirectional stream the first message will be
+		 * the READY control frame. We can only continue writing after
+		 * receiving an ACCEPT control frame. */
+		if(dtio->is_bidirectional && !dtio->ready_frame_sent) {
+			dtio->ready_frame_sent = 1;
+			(void)dtio_add_output_event_read(dtio);
+			break;
+		}
 	}
 }
 
@@ -1224,15 +1469,13 @@ void dtio_cmd_cb(int fd, short ATTR_UNUSED(bits), void* arg)
 #ifndef USE_WINSOCK
 		if(errno == EINTR || errno == EAGAIN)
 			return; /* ignore this */
-		log_err("dnstap io: failed to read: %s", strerror(errno));
 #else
 		if(WSAGetLastError() == WSAEINPROGRESS)
 			return;
 		if(WSAGetLastError() == WSAEWOULDBLOCK)
 			return;
-		log_err("dnstap io: failed to read: %s",
-			wsa_strerror(WSAGetLastError()));
 #endif
+		log_err("dnstap io: failed to read: %s", sock_strerror(errno));
 		/* and then fall through to quit the thread */
 	} else if(r == 0) {
 		verbose(VERB_ALGO, "dnstap io: cmd channel closed");
@@ -1240,6 +1483,13 @@ void dtio_cmd_cb(int fd, short ATTR_UNUSED(bits), void* arg)
 		verbose(VERB_ALGO, "dnstap io: cmd channel cmd quit");
 	} else if(r == 1 && cmd == DTIO_COMMAND_WAKEUP) {
 		verbose(VERB_ALGO, "dnstap io: cmd channel cmd wakeup");
+
+		if(dtio->is_bidirectional && !dtio->accept_frame_received) {
+			verbose(VERB_ALGO, "dnstap io: cmd wakeup ignored, "
+				"waiting for ACCEPT control frame");
+			return;
+		}
+
 		/* reregister event */
 		if(!dtio_add_output_event_write(dtio))
 			return;
@@ -1561,6 +1811,25 @@ static int dtio_control_start_send(struct dt_io_thread* dtio)
 	return 1;
 }
 
+/** setup a ready control message */
+static int dtio_control_ready_send(struct dt_io_thread* dtio)
+{
+	log_assert(dtio->cur_msg == NULL && dtio->cur_msg_len == 0);
+	dtio->cur_msg = fstrm_create_control_frame_ready(DNSTAP_CONTENT_TYPE,
+		&dtio->cur_msg_len);
+	if(!dtio->cur_msg) {
+		return 0;
+	}
+	/* setup to send the control message */
+	/* set that the buffer needs to be sent, but the length
+	 * of that buffer is already written, that way the buffer can
+	 * start with 0 length and then the length of the control frame
+	 * in it */
+	dtio->cur_msg_done = 0;
+	dtio->cur_msg_len_done = 4;
+	return 1;
+}
+
 /** open the output file descriptor for af_local */
 static int dtio_open_output_local(struct dt_io_thread* dtio)
 {
@@ -1568,13 +1837,8 @@ static int dtio_open_output_local(struct dt_io_thread* dtio)
 	struct sockaddr_un s;
 	dtio->fd = socket(AF_LOCAL, SOCK_STREAM, 0);
 	if(dtio->fd == -1) {
-#ifndef USE_WINSOCK
 		log_err("dnstap io: failed to create socket: %s",
-			strerror(errno));
-#else
-		log_err("dnstap io: failed to create socket: %s",
-			wsa_strerror(WSAGetLastError()));
-#endif
+			sock_strerror(errno));
 		return 0;
 	}
 	memset(&s, 0, sizeof(s));
@@ -1589,13 +1853,13 @@ static int dtio_open_output_local(struct dt_io_thread* dtio)
 	if(connect(dtio->fd, (struct sockaddr*)&s, (socklen_t)sizeof(s))
 		== -1) {
 		char* to = dtio->socket_path;
-#ifndef USE_WINSOCK
+		if(dtio->reconnect_timeout > DTIO_RECONNECT_TIMEOUT_MIN &&
+			verbosity < 4) {
+			dtio_close_fd(dtio);
+			return 0; /* no log retries on low verbosity */
+		}
 		log_err("dnstap io: failed to connect to \"%s\": %s",
-			to, strerror(errno));
-#else
-		log_err("dnstap io: failed to connect to \"%s\": %s",
-			to, wsa_strerror(WSAGetLastError()));
-#endif
+			to, sock_strerror(errno));
 		dtio_close_fd(dtio);
 		return 0;
 	}
@@ -1620,18 +1884,18 @@ static int dtio_open_output_tcp(struct dt_io_thread* dtio)
 	}
 	dtio->fd = socket(addr.ss_family, SOCK_STREAM, 0);
 	if(dtio->fd == -1) {
-#ifndef USE_WINSOCK
-		log_err("can't create socket: %s", strerror(errno));
-#else
-		log_err("can't create socket: %s",
-			wsa_strerror(WSAGetLastError()));
-#endif
+		log_err("can't create socket: %s", sock_strerror(errno));
 		return 0;
 	}
 	fd_set_nonblock(dtio->fd);
 	if(connect(dtio->fd, (struct sockaddr*)&addr, addrlen) == -1) {
 		if(errno == EINPROGRESS)
 			return 1; /* wait until connect done*/
+		if(dtio->reconnect_timeout > DTIO_RECONNECT_TIMEOUT_MIN &&
+			verbosity < 4) {
+			dtio_close_fd(dtio);
+			return 0; /* no log retries on low verbosity */
+		}
 #ifndef USE_WINSOCK
 		if(tcp_connect_errno_needs_log(
 			(struct sockaddr *)&addr, addrlen)) {
@@ -1693,7 +1957,8 @@ static void dtio_open_output(struct dt_io_thread* dtio)
 	}
 	dtio->check_nb_connect = 1;
 
-	/* the EV_READ is to catch channel close, write to write packets */
+	/* the EV_READ is to read ACCEPT control messages, and catch channel
+	 * close. EV_WRITE is to write packets */
 	ev = ub_event_new(dtio->event_base, dtio->fd,
 		UB_EV_READ | UB_EV_WRITE | UB_EV_PERSIST, &dtio_output_cb,
 		dtio);
@@ -1712,7 +1977,8 @@ static void dtio_open_output(struct dt_io_thread* dtio)
 	dtio->event = ev;
 
 	/* setup protocol control message to start */
-	if(!dtio_control_start_send(dtio)) {
+	if((!dtio->is_bidirectional && !dtio_control_start_send(dtio)) ||
+		(dtio->is_bidirectional && !dtio_control_ready_send(dtio)) ) {
 		log_err("dnstap io: out of memory");
 		ub_event_free(dtio->event);
 		dtio->event = NULL;
@@ -1811,15 +2077,14 @@ void dt_io_thread_stop(struct dt_io_thread* dtio)
 #ifndef USE_WINSOCK
 			if(errno == EINTR || errno == EAGAIN)
 				continue;
-			log_err("dnstap io stop: write: %s", strerror(errno));
 #else
 			if(WSAGetLastError() == WSAEINPROGRESS)
 				continue;
 			if(WSAGetLastError() == WSAEWOULDBLOCK)
 				continue;
-			log_err("dnstap io stop: write: %s",
-				wsa_strerror(WSAGetLastError()));
 #endif
+			log_err("dnstap io stop: write: %s",
+				sock_strerror(errno));
 			break;
 		}
 		break;
diff --git a/dnstap/dtstream.h b/dnstap/dtstream.h
index 03346c213..ede491f30 100644
--- a/dnstap/dtstream.h
+++ b/dnstap/dtstream.h
@@ -88,6 +88,27 @@ struct dt_msg_entry {
 	size_t len;
 };
 
+/**
+ * Containing buffer and counter for reading DNSTAP frames.
+ */
+struct dt_frame_read_buf {
+	/** Buffer containing frame, except length counter(s). */
+	void* buf;
+	/** Number of bytes written to buffer. */
+	size_t buf_count;
+	/** Capacity of the buffer. */
+	size_t buf_cap;
+
+	/** Frame length field. Will contain the 2nd length field for control
+	 * frames. */
+	uint32_t frame_len;
+	/** Number of bytes that have been written to the frame_length field. */
+	size_t frame_len_done;
+
+	/** Set to 1 if this is a control frame, 0 otherwise (ie data frame). */
+	int control_frame;
+};
+
 /**
  * IO thread that reads from the queues and writes them.
  */
@@ -130,6 +151,9 @@ struct dt_io_thread {
 	 * This happens during negotiation, we then do not want to write,
 	 * but wait for a read event. */
 	int ssl_brief_read;
+	/** true if SSL_read is waiting for a write event. Set back to 0 after
+	 * single write event is handled. */
+	int ssl_brief_write;
 
 	/** the buffer that currently getting written, or NULL if no
 	 * (partial) message written now */
@@ -171,6 +195,16 @@ struct dt_io_thread {
 	 * and client certificates can be used for authentication. */
 	int upstream_is_tls;
 
+	/** Perform bidirectional Frame Streams handshake before sending
+	 * messages. */
+	int is_bidirectional;
+	/** Set if the READY control frame has been sent. */
+	int ready_frame_sent;
+	/** Set if valid ACCEPT frame is received. */
+	int accept_frame_received;
+	/** (partially) read frame */
+	struct dt_frame_read_buf read_frame;
+
 	/** the file path for unix socket (or NULL) */
 	char* socket_path;
 	/** the ip address and port number (or NULL) */
diff --git a/dnstap/unbound-dnstap-socket.c b/dnstap/unbound-dnstap-socket.c
index 97ed7a087..ca950c8bf 100644
--- a/dnstap/unbound-dnstap-socket.c
+++ b/dnstap/unbound-dnstap-socket.c
@@ -278,57 +278,31 @@ static int make_tcp_accept(char* ip)
 	}
 
 	if((s = socket(addr.ss_family, SOCK_STREAM, 0)) == -1) {
-#ifndef USE_WINSOCK
-		log_err("can't create socket: %s", strerror(errno));
-#else
-		log_err("can't create socket: %s",
-			wsa_strerror(WSAGetLastError()));
-#endif
+		log_err("can't create socket: %s", sock_strerror(errno));
 		return -1;
 	}
 #ifdef SO_REUSEADDR
 	if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on,
 		(socklen_t)sizeof(on)) < 0) {
-#ifndef USE_WINSOCK
 		log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
-			strerror(errno));
-		close(s);
-#else
-		log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
-			wsa_strerror(WSAGetLastError()));
-		closesocket(s);
-#endif
+			sock_strerror(errno));
+		sock_close(s);
 		return -1;
 	}
 #endif /* SO_REUSEADDR */
 	if(bind(s, (struct sockaddr*)&addr, len) != 0) {
-#ifndef USE_WINSOCK
-		log_err_addr("can't bind socket", strerror(errno),
+		log_err_addr("can't bind socket", sock_strerror(errno),
 			&addr, len);
-		close(s);
-#else
-		log_err_addr("can't bind socket",
-			wsa_strerror(WSAGetLastError()), &addr, len);
-		closesocket(s);
-#endif
+		sock_close(s);
 		return -1;
 	}
 	if(!fd_set_nonblock(s)) {
-#ifndef USE_WINSOCK
-		close(s);
-#else
-		closesocket(s);
-#endif
+		sock_close(s);
 		return -1;
 	}
 	if(listen(s, LISTEN_BACKLOG) == -1) {
-#ifndef USE_WINSOCK
-		log_err("can't listen: %s", strerror(errno));
-		close(s);
-#else
-		log_err("can't listen: %s", wsa_strerror(WSAGetLastError()));
-		closesocket(s);
-#endif
+		log_err("can't listen: %s", sock_strerror(errno));
+		sock_close(s);
 		return -1;
 	}
 	return s;
@@ -654,7 +628,6 @@ static ssize_t receive_bytes(struct tap_data* data, int fd, void* buf,
 #ifndef USE_WINSOCK
 		if(errno == EINTR || errno == EAGAIN)
 			return -1;
-		log_err("could not recv: %s", strerror(errno));
 #else /* USE_WINSOCK */
 		if(WSAGetLastError() == WSAEINPROGRESS)
 			return -1;
@@ -662,9 +635,8 @@ static ssize_t receive_bytes(struct tap_data* data, int fd, void* buf,
 			ub_winsock_tcp_wouldblock(data->ev, UB_EV_READ);
 			return -1;
 		}
-		log_err("could not recv: %s",
-			wsa_strerror(WSAGetLastError()));
 #endif
+		log_err("could not recv: %s", sock_strerror(errno));
 		if(verbosity) log_info("dnstap client stream closed from %s",
 			(data->id?data->id:""));
 		return 0;
@@ -770,10 +742,11 @@ void tap_data_free(struct tap_data* data)
 
 /** reply with ACCEPT control frame to bidirectional client,
  * returns 0 on error */
-static int reply_with_accept(int fd)
+static int reply_with_accept(struct tap_data* data)
 {
 #ifdef USE_DNSTAP
 	/* len includes the escape and framelength */
+	int r;
 	size_t len = 0;
 	void* acceptframe = fstrm_create_control_frame_accept(
 		DNSTAP_CONTENT_TYPE, &len);
@@ -782,26 +755,34 @@ static int reply_with_accept(int fd)
 		return 0;
 	}
 
-	fd_set_block(fd);
-	if(send(fd, acceptframe, len, 0) == -1) {
-#ifndef USE_WINSOCK
-		log_err("send failed: %s", strerror(errno));
-#else
-		log_err("send failed: %s", wsa_strerror(WSAGetLastError()));
-#endif
-		fd_set_nonblock(fd);
-		free(acceptframe);
-		return 0;
+	fd_set_block(data->fd);
+	if(data->ssl) {
+		if((r=SSL_write(data->ssl, acceptframe, len)) <= 0) {
+			if(SSL_get_error(data->ssl, r) == SSL_ERROR_ZERO_RETURN)
+				log_err("SSL_write, peer closed connection");
+			else
+				log_err("could not SSL_write");
+			fd_set_nonblock(data->fd);
+			free(acceptframe);
+			return 0;
+		}
+	} else {
+		if(send(data->fd, acceptframe, len, 0) == -1) {
+			log_err("send failed: %s", sock_strerror(errno));
+			fd_set_nonblock(data->fd);
+			free(acceptframe);
+			return 0;
+		}
 	}
 	if(verbosity) log_info("sent control frame(accept) content-type:(%s)",
 			DNSTAP_CONTENT_TYPE);
 
-	fd_set_nonblock(fd);
+	fd_set_nonblock(data->fd);
 	free(acceptframe);
 	return 1;
 #else
 	log_err("no dnstap compiled, no reply");
-	(void)fd;
+	(void)data;
 	return 0;
 #endif
 }
@@ -820,11 +801,7 @@ static int reply_with_finish(int fd)
 
 	fd_set_block(fd);
 	if(send(fd, finishframe, len, 0) == -1) {
-#ifndef USE_WINSOCK
-		log_err("send failed: %s", strerror(errno));
-#else
-		log_err("send failed: %s", wsa_strerror(WSAGetLastError()));
-#endif
+		log_err("send failed: %s", sock_strerror(errno));
 		fd_set_nonblock(fd);
 		free(finishframe);
 		return 0;
@@ -1033,7 +1010,7 @@ void dtio_tap_callback(int fd, short ATTR_UNUSED(bits), void* arg)
 		FSTRM_CONTROL_FRAME_READY) {
 		data->is_bidirectional = 1;
 		if(verbosity) log_info("bidirectional stream");
-		if(!reply_with_accept(fd)) {
+		if(!reply_with_accept(data)) {
 			tap_data_free(data);
 		}
 	} else if(data->len >= 4 && sldns_read_uint32(data->frame) ==
@@ -1080,7 +1057,6 @@ void dtio_mainfdcallback(int fd, short ATTR_UNUSED(bits), void* arg)
 #endif /* EPROTO */
 			)
 			return;
-		log_err_addr("accept failed", strerror(errno), &addr, addrlen);
 #else /* USE_WINSOCK */
 		if(WSAGetLastError() == WSAEINPROGRESS ||
 			WSAGetLastError() == WSAECONNRESET)
@@ -1089,9 +1065,9 @@ void dtio_mainfdcallback(int fd, short ATTR_UNUSED(bits), void* arg)
 			ub_winsock_tcp_wouldblock(maindata->ev, UB_EV_READ);
 			return;
 		}
-		log_err_addr("accept failed", wsa_strerror(WSAGetLastError()),
-			&addr, addrlen);
 #endif
+		log_err_addr("accept failed", sock_strerror(errno), &addr,
+			addrlen);
 		return;
 	}
 	fd_set_nonblock(s);
diff --git a/doc/Changelog b/doc/Changelog
index ff3810b9d..db4b27a2c 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,149 @@
+15 September 2020: George
+	- Introduce test for statistics.
+
+15 September 2020: Wouter
+	- Spelling fix.
+
+11 September 2020: Wouter
+	- Remove x file mode on ipset/ipset.c and h files.
+
+9 September 2020: Wouter
+	- Fix num.expired statistics output.
+
+31 August 2020: Wouter
+	- Merge PR #293: Add missing prototype.  Also refactor to use the new
+	  shorthand function to clean up the code.
+	- Refactor to use sock_strerr shorthand function.
+	- Fix #296: systemd nss-lookup.target is reached before unbound can
+	  successfully answer queries. Changed contrib/unbound.service.in.
+
+27 August 2020: Wouter
+	- Similar to NSD PR#113, implement that interface names can be used,
+	  eg. something like interface: eth0 is resolved at server start and
+	  uses the IP addresses for that named interface.
+	- Review fix, doxygen and assign null in case of error free.
+
+26 August 2020: George
+	- Update documentation in python example code.
+
+24 August 2020: Wouter
+	- Fix that dnstap reconnects do not spam the log with the repeated
+	  attempts.  Attempts on the timer are only logged on high verbosity,
+	  if they produce a connection failure error.
+	- Fix to apply chroot to dnstap-socket-path, if chroot is enabled.
+	- Change configure to use EVP_sha256 instead of HMAC_Update for
+	  openssl-3.0.0.
+
+20 August 2020: Ralph
+	- Fix stats double count issue (#289).
+
+13 August 2020: Ralph
+	- Create and init edns tags data for libunbound.
+
+10 August 2020: Ralph
+	- Merge (modified) PR #277, use EVP_MAC_CTX_set_params if available,
+	  by Vítězslav Čížek.
+
+10 August 2020: Wouter
+	- Fix #287: doc typo: "Additionaly".
+	- Rerun autoconf
+
+6 August 2020: Wouter
+	- Merge PR #284 and Fix #246: Remove DLV entirely from Unbound.
+	  The DLV has been decommisioned and in unbound 1.5.4, in 2015, there
+	  was advise to stop using it.  The current code base does not contain
+	  DLV code any more.  The use of dlv options displays a warning.
+
+5 August 2020: Wouter
+	- contrib/aaaa-filter-iterator.patch file renewed diff content to
+	  apply cleanly to the current coderepo for the current code version.
+
+5 August 2020: Ralph
+	- Merge PR #272: Add EDNS client tag functionality.
+
+4 August 2020: George
+	- Improve error log message when inserting rpz RR.
+	- Merge PR #280, Make tvOS & watchOS checks verify truthiness as well as
+	  definedness, by Felipe Gasper.
+
+4 August 2020: Wouter
+	- Fix mini_event.h on OpenBSD cannot find fd_set.
+
+31 July 2020: Wouter
+	- Fix doxygen comment for no ssl for tls session ticket key callback
+	  routine.
+
+27 July 2020: George
+	- Merge PR #268, draft-ietf-dnsop-serve-stale-10 has become RFC 8767 on
+	  March 2020, by and0x000.
+
+27 July 2020: Ralph
+	- Merge PR #269, Fix python module len() implementations, by Torbjörn
+	  Lönnemark
+
+27 July 2020: Wouter
+	- branch now named 1.11.1.  1.11.0rc1 became the 1.11.0 release.
+	- Merge PR #270 from cgzones: munin plugin: always exit 0 in autoconf
+
+20 July 2020: Wouter
+	- Fix streamtcp to print packet data to stdout.  This makes the
+	  stdout and stderr not mix together lines, when parsing its output.
+	- Fix contrib/fastrpz.patch to apply cleanly.  It fixes for changes
+	  due to added libdynmod, but it does not compile, it conflicts with
+	  new rpz code.
+	- branch now named 1.11.0 and 1.11.0rc1 tag.
+
+17 July 2020: Wouter
+	- Fix libnettle compile for session ticket key callback function
+	  changes.
+	- Fix lock dependency cycle in rpz zone config setup.
+
+17 July 2020: Ralph
+	- Merge PR #234 - Ensure proper alignment of cmsg buffers by Jérémie
+	  Courrèges-Anglas.
+	- Fix PR #234 log_assert sizeof to use union buffer.
+
+16 July 2020: Wouter
+	- Fix check conf test for referencing installation paths.
+	- Fix unused variable warning for clang analyzer.
+
+16 July 2020: George
+	- Introduce 'include-toplevel:' configuration option.
+
+16 July 2020: Ralph
+	- Add bidirectional frame streams support.
+
+8 July 2020: Wouter
+	- Fix add missing DSA header, for compilation without deprecated
+	  OpenSSL APIs.
+	- Fix to use SSL_CTX_set_tlsext_ticket_key_evp_cb in OpenSSL
+	  3.0.0-alpha4.
+	- Longer keys for the test set, this avoids weak crypto errors.
+
+7 July 2020: Wouter
+	- Fix #259: Fix unbound-checkconf does not check view existence.
+	  unbound-checkconf checks access-control-view, access-control-tags,
+	  access-control-tag-actions and access-control-tag-datas.
+	- Fix offset of error printout for access-control-tag-datas.
+	- Review fixes for checkconf #259 change.
+
+6 July 2020: Wouter
+	- run_vm cleanup better and removes trailing slash on single argument.
+
+29 June 2020: Wouter
+	- Move reply list clean for serve expired mesh callback to after
+	  the reply is sent, so that script callbacks have reply_info.
+	- Also move reply list clean for mesh callbacks to the scrip callback
+	  can see the reply_info.
+	- Fix for mesh accounting if the reply list already empty to begin
+	  with.
+	- Fix for mesh accounting when rpz decides to drop a reply with a
+	  tcp stream waiting for it.
+	- Review fix for number of detached states due to use of variable
+	  after end of loop.
+	- Fix tcp req info drop due to size call into mesh accounting
+	  removal of mesh state during mesh send reply.
+
 24 June 2020: Wouter
 	- iana portlist updated.
 	- doxygen file comments for dynlibmodule.
diff --git a/doc/example.conf.in b/doc/example.conf.in
index 7a92de01c..8af853fb4 100644
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -5,9 +5,13 @@
 #
 # this is a comment.
 
-#Use this to include other text into the file.
+# Use this anywhere in the file to include other text into this file.
 #include: "otherfile.conf"
 
+# Use this anywhere in the file to include other text, that explicitly starts a
+# clause, into this file. Text after this directive needs to start a clause.
+#include-toplevel: "otherfile.conf"
+
 # The server clause sets the main parameters.
 server:
 	# whitespace is not necessary, but looks cleaner.
@@ -505,11 +509,6 @@ server:
 	# Root key trust anchor sentinel (draft-ietf-dnsop-kskroll-sentinel)
 	# root-key-sentinel: yes
 
-	# File with DLV trusted keys. Same format as trust-anchor-file.
-	# There can be only one DLV configured, it is trusted from root down.
-	# DLV is going to be decommissioned.  Please do not use it any more.
-	# dlv-anchor-file: "dlv.isc.org.key"
-
 	# File with trusted keys for validation. Specify more than one file
 	# with several entries, one file per entry.
 	# Zone file format, with DS and DNSKEY entries.
@@ -585,7 +584,7 @@ server:
 	#
 	# Time in milliseconds before replying to the client with expired data.
 	# This essentially enables the serve-stale behavior as specified in
-	# draft-ietf-dnsop-serve-stale-10 that first tries to resolve before
+	# RFC 8767 that first tries to resolve before
 	# immediately responding with expired data.  0 disables this behavior.
 	# A recommended value is 1800.
 	# serve-expired-client-timeout: 0
@@ -623,7 +622,7 @@ server:
 	# more slabs reduce lock contention, but fragment memory usage.
 	# key-cache-slabs: 4
 
-	# the amount of memory to use for the negative cache (used for DLV).
+	# the amount of memory to use for the negative cache.
 	# plain value in bytes or you can append k, m or G. default is "1Mb".
 	# neg-cache-size: 1m
 
@@ -1064,6 +1063,8 @@ remote-control:
 # upstream log destination, by socket path, TCP or TLS destination.
 # dnstap:
 # 	dnstap-enable: no
+# 	# if set to yes frame streams will be used in bidirectional mode
+# 	dnstap-bidirectional: yes
 # 	dnstap-socket-path: "@DNSTAP_SOCKET_PATH@"
 # 	# if "" use the unix socket in dnstap-socket-path, otherwise,
 # 	# set it to "IPaddress[@port]" of the destination.
diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 35eac2608..c2b6d6eb7 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -77,6 +77,12 @@ for the included files works, relative pathnames for the included names work
 if the directory where the daemon is started equals its chroot/working
 directory or is specified before the include statement with directory: dir.
 Wildcards can be used to include multiple files, see \fIglob\fR(7).
+.P
+For a more structural include option, the
+.B include\-toplevel:
+directive can be used.  This closes whatever clause is currently active (if any)
+and forces the use of clauses in the included files and right after this
+directive.
 .SS "Server Options"
 These options are part of the
 .B server:
@@ -116,7 +122,8 @@ The port number, default 53, on which the server responds to queries.
 Interface to use to connect to the network. This interface is listened to
 for queries from clients, and answers to clients are given from it.
 Can be given multiple times to work on several interfaces. If none are
-given the default is to listen to localhost.
+given the default is to listen to localhost.  If an interface name is used
+instead of an ip address, the list of ip addresses on that interface are used.
 The interfaces are not changed on a reload (kill \-HUP) but only on restart.
 A port number can be specified with @port (without spaces between
 interface and port number), if not specified the default port (from
@@ -1034,26 +1041,11 @@ Send RFC8145 key tag query after trust anchor priming. Default is yes.
 .B root\-key\-sentinel: \fI<yes or no>
 Root key trust anchor sentinel. Default is yes.
 .TP
-.B dlv\-anchor\-file: \fI<filename>
-This option was used during early days DNSSEC deployment when no parent-side
-DS record registrations were easily available.  Nowadays, it is best to have
-DS records registered with the parent zone (many top level zones are signed).
-File with trusted keys for DLV (DNSSEC Lookaside Validation). Both DS and
-DNSKEY entries can be used in the file, in the same format as for
-\fItrust\-anchor\-file:\fR statements. Only one DLV can be configured, more
-would be slow. The DLV configured is used as a root trusted DLV, this
-means that it is a lookaside for the root. Default is "", or no dlv anchor
-file. DLV is going to be decommissioned.  Please do not use it any more.
-.TP
-.B dlv\-anchor: \fI<"Resource Record">
-Much like trust\-anchor, this is a DLV anchor with the DS or DNSKEY inline.
-DLV is going to be decommissioned.  Please do not use it any more.
-.TP
 .B domain\-insecure: \fI<domain name>
 Sets domain name to be insecure, DNSSEC chain of trust is ignored towards
 the domain name.  So a trust anchor above the domain name can not make the
 domain secure with a DS record, such a DS record is then ignored.
-Also keys from DLV are ignored for the domain.  Can be given multiple times
+Can be given multiple times
 to specify multiple domains that are treated as if unsigned.  If you set
 trust anchors for the domain they override this setting (and the domain
 is secured).
@@ -1132,7 +1124,7 @@ later on.  Default is "no".
 .B serve\-expired\-ttl: \fI<seconds>
 Limit serving of expired responses to configured seconds after expiration. 0
 disables the limit.  This option only applies when \fBserve\-expired\fR is
-enabled.  A suggested value per draft-ietf-dnsop-serve-stale-10 is between
+enabled.  A suggested value per RFC 8767 is between
 86400 (1 day) and 259200 (3 days).  The default is 0.
 .TP
 .B serve\-expired\-ttl\-reset: \fI<yes or no>
@@ -1144,14 +1136,14 @@ expired records will be served as long as there are queries for it.  Default is
 .B serve\-expired\-reply\-ttl: \fI<seconds>
 TTL value to use when replying with expired data.  If
 \fBserve\-expired\-client\-timeout\fR is also used then it is RECOMMENDED to
-use 30 as the value (draft-ietf-dnsop-serve-stale-10).  The default is 30.
+use 30 as the value (RFC 8767).  The default is 30.
 .TP
 .B serve\-expired\-client\-timeout: \fI<msec>
 Time in milliseconds before replying to the client with expired data.  This
 essentially enables the serve-stale behavior as specified in
-draft-ietf-dnsop-serve-stale-10 that first tries to resolve before immediately
+RFC 8767 that first tries to resolve before immediately
 responding with expired data.  A recommended value per
-draft-ietf-dnsop-serve-stale-10 is 1800.  Setting this to 0 will disable this
+RFC 8767 is 1800.  Setting this to 0 will disable this
 behavior.  Default is 0.
 .TP
 .B val\-nsec3\-keysize\-iterations: \fI<"list of values">
@@ -1540,6 +1532,12 @@ servers set. The default for fast\-server\-permil is 0.
 Set the number of servers that should be used for fast server selection. Only
 use the fastest specified number of servers with the fast\-server\-permil
 option, that turns this on or off. The default is to use the fastest 3 servers.
+.TP 5
+.B edns\-client\-tag: \fI<IP netblock> <tag data>
+Include an edns-client-tag option in queries with destination address matching
+the configured IP netblock. This configuration option can be used multiple
+times. The most specific match will be used. The tag data is configured in
+decimal format, from 0 to 65535.
 .SS "Remote Control Options"
 In the
 .B remote\-control:
@@ -2134,7 +2132,7 @@ even if some data have expired in terms of DNS TTL or the Redis server has
 cached too much data;
 if necessary the Redis server must be configured to limit the cache size,
 preferably with some kind of least-recently-used eviction policy.
-Additionaly, the \fBredis\-expire\-records\fR option can be used in order to
+Additionally, the \fBredis\-expire\-records\fR option can be used in order to
 set the relative DNS TTL of the message as timeout to the Redis records; keep
 in mind that some additional memory is used per key and that the expire
 information is stored as absolute Unix timestamps in Redis (computer time must
@@ -2213,6 +2211,10 @@ If dnstap is enabled.  Default no.  If yes, it connects to the dnstap server
 and if any of the dnstap-log-..-messages options is enabled it sends logs
 for those messages to the server.
 .TP
+.B dnstap-bidirectional: \fI<yes or no>
+Use frame streams in bidirectional mode to transfer DNSTAP messages. Default is
+yes.
+.TP
 .B dnstap-socket-path: \fI<file name>
 Sets the unix socket file name for connecting to the server that is
 listening on that socket.  Default is "@DNSTAP_SOCKET_PATH@".
diff --git a/ipset/ipset.c b/ipset/ipset.c
old mode 100755
new mode 100644
diff --git a/ipset/ipset.h b/ipset/ipset.h
old mode 100755
new mode 100644
diff --git a/iterator/iterator.c b/iterator/iterator.c
index 23b07ea90..99d020117 100644
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -3191,7 +3191,7 @@ processPrimeResponse(struct module_qstate* qstate, int id)
 	/* validate the root or stub after priming (if enabled).
 	 * This is the same query as the prime query, but with validation.
 	 * Now that we are primed, the additional queries that validation
-	 * may need can be resolved, such as DLV. */
+	 * may need can be resolved. */
 	if(qstate->env->cfg->harden_referral_path) {
 		struct module_qstate* subq = NULL;
 		log_nametypeclass(VERB_ALGO, "schedule prime validation", 
diff --git a/libunbound/context.c b/libunbound/context.c
index 6d62e32b5..713259c71 100644
--- a/libunbound/context.c
+++ b/libunbound/context.c
@@ -50,6 +50,7 @@
 #include "services/authzone.h"
 #include "util/data/msgreply.h"
 #include "util/storage/slabhash.h"
+#include "util/edns.h"
 #include "sldns/sbuffer.h"
 
 int 
@@ -79,6 +80,8 @@ context_finalize(struct ub_ctx* ctx)
 		return UB_INITFAIL;
 	if(!auth_zones_apply_cfg(ctx->env->auth_zones, cfg, 1, &is_rpz))
 		return UB_INITFAIL;
+	if(!edns_tags_apply_cfg(ctx->env->edns_tags, cfg))
+		return UB_INITFAIL;
 	if(!slabhash_is_size(ctx->env->msg_cache, cfg->msg_cache_size,
 		cfg->msg_cache_slabs)) {
 		slabhash_delete(ctx->env->msg_cache);
diff --git a/libunbound/libunbound.c b/libunbound/libunbound.c
index 3b30419b3..af26e5546 100644
--- a/libunbound/libunbound.c
+++ b/libunbound/libunbound.c
@@ -58,6 +58,7 @@
 #include "util/net_help.h"
 #include "util/tube.h"
 #include "util/ub_event.h"
+#include "util/edns.h"
 #include "services/modstack.h"
 #include "services/localzone.h"
 #include "services/cache/infra.h"
@@ -153,6 +154,18 @@ static struct ub_ctx* ub_ctx_create_nopipe(void)
 		errno = ENOMEM;
 		return NULL;
 	}
+	ctx->env->edns_tags = edns_tags_create();
+	if(!ctx->env->edns_tags) {
+		auth_zones_delete(ctx->env->auth_zones);
+		edns_known_options_delete(ctx->env);
+		config_delete(ctx->env->cfg);
+		free(ctx->env);
+		ub_randfree(ctx->seed_rnd);
+		free(ctx);
+		errno = ENOMEM;
+		return NULL;
+	}
+
 	ctx->env->alloc = &ctx->superalloc;
 	ctx->env->worker = NULL;
 	ctx->env->need_to_validate = 0;
diff --git a/libunbound/libworker.c b/libunbound/libworker.c
index 44b8d7905..bd42462e1 100644
--- a/libunbound/libworker.c
+++ b/libunbound/libworker.c
@@ -78,7 +78,7 @@
 #include <TargetConditionals.h>
 #endif
 
-#if defined(TARGET_OS_TV) || defined(TARGET_OS_WATCH)
+#if (defined(TARGET_OS_TV) && TARGET_OS_TV) || (defined(TARGET_OS_WATCH) && TARGET_OS_WATCH)
 #undef HAVE_FORK
 #endif
 
diff --git a/pythonmod/doc/modules/config.rst b/pythonmod/doc/modules/config.rst
index 43333bdae..89afbef8a 100644
--- a/pythonmod/doc/modules/config.rst
+++ b/pythonmod/doc/modules/config.rst
@@ -256,14 +256,6 @@ config_file
    
       Files with trusted DNSKEYs in named.conf format, list.
    
-   .. attribute:: dlv_anchor_file
-   
-      DLV anchor file.
-   
-   .. attribute:: dlv_anchor_list
-   
-      DLV anchor inline.
-
    .. attribute:: max_ttl
    
       The number of seconds maximal TTL used for RRsets and messages.
diff --git a/pythonmod/examples/avahi-resolver.py b/pythonmod/examples/avahi-resolver.py
index b1d4e36fc..497e1e74f 100644
--- a/pythonmod/examples/avahi-resolver.py
+++ b/pythonmod/examples/avahi-resolver.py
@@ -59,6 +59,8 @@
 # |   num-threads: 32
 # |   cache-max-negative-ttl: 60
 # |   cache-max-ttl: 60
+# | python:
+# |   python-script: path/to/this/file
 #
 #
 # The plugin can also be run interactively. Provide the name and
diff --git a/pythonmod/interface.i b/pythonmod/interface.i
index c02ebaf95..71f2bf774 100644
--- a/pythonmod/interface.i
+++ b/pythonmod/interface.i
@@ -314,16 +314,16 @@ struct packed_rrset_data {
     class RRSetData_RRLen:
         def __init__(self, obj): self.obj = obj
         def __getitem__(self, index): return _unboundmodule._get_data_rr_len(self.obj, index)
-        def __len__(self): return obj.count + obj.rrsig_count
+        def __len__(self): return self.obj.count + self.obj.rrsig_count
     class RRSetData_RRTTL:
         def __init__(self, obj): self.obj = obj
         def __getitem__(self, index): return _unboundmodule._get_data_rr_ttl(self.obj, index)
         def __setitem__(self, index, value): _unboundmodule._set_data_rr_ttl(self.obj, index, value)
-        def __len__(self): return obj.count + obj.rrsig_count
+        def __len__(self): return self.obj.count + self.obj.rrsig_count
     class RRSetData_RRData:
         def __init__(self, obj): self.obj = obj
         def __getitem__(self, index): return _unboundmodule._get_data_rr_data(self.obj, index)
-        def __len__(self): return obj.count + obj.rrsig_count
+        def __len__(self): return self.obj.count + self.obj.rrsig_count
 %}
 
 %inline %{
@@ -404,12 +404,12 @@ struct dns_msg {
     class ReplyInfo_RRSet:
         def __init__(self, obj): self.obj = obj
         def __getitem__(self, index): return _unboundmodule._rrset_rrsets_get(self.obj, index)
-        def __len__(self): return obj.rrset_count
+        def __len__(self): return self.obj.rrset_count
 
     class ReplyInfo_Ref:
         def __init__(self, obj): self.obj = obj
         def __getitem__(self, index): return _unboundmodule._rrset_ref_get(self.obj, index)
-        def __len__(self): return obj.rrset_count
+        def __len__(self): return self.obj.rrset_count
 %}
 
 %inline %{
@@ -992,8 +992,6 @@ struct config_file {
    struct config_strlist* trust_anchor_file_list;
    struct config_strlist* trust_anchor_list;
    struct config_strlist* trusted_keys_file_list;
-   char* dlv_anchor_file;
-   struct config_strlist* dlv_anchor_list;
    int max_ttl;
    int32_t val_date_override;
    int bogus_ttl;
diff --git a/services/authzone.c b/services/authzone.c
index 9b0568c8c..a26d1003a 100644
--- a/services/authzone.c
+++ b/services/authzone.c
@@ -1866,15 +1866,26 @@ auth_zones_cfg(struct auth_zones* az, struct config_auth* c)
 	struct auth_xfer* x = NULL;
 
 	/* create zone */
+	if(c->isrpz) {
+		/* if the rpz lock is needed, grab it before the other
+		 * locks to avoid a lock dependency cycle */
+		lock_rw_wrlock(&az->rpz_lock);
+	}
 	lock_rw_wrlock(&az->lock);
 	if(!(z=auth_zones_find_or_add_zone(az, c->name))) {
 		lock_rw_unlock(&az->lock);
+		if(c->isrpz) {
+			lock_rw_unlock(&az->rpz_lock);
+		}
 		return 0;
 	}
 	if(c->masters || c->urls) {
 		if(!(x=auth_zones_find_or_add_xfer(az, z))) {
 			lock_rw_unlock(&az->lock);
 			lock_rw_unlock(&z->lock);
+			if(c->isrpz) {
+				lock_rw_unlock(&az->rpz_lock);
+			}
 			return 0;
 		}
 	}
@@ -1889,6 +1900,9 @@ auth_zones_cfg(struct auth_zones* az, struct config_auth* c)
 			lock_basic_unlock(&x->lock);
 		}
 		lock_rw_unlock(&z->lock);
+		if(c->isrpz) {
+			lock_rw_unlock(&az->rpz_lock);
+		}
 		return 0;
 	}
 	z->for_downstream = c->for_downstream;
@@ -1900,11 +1914,13 @@ auth_zones_cfg(struct auth_zones* az, struct config_auth* c)
 			return 0;
 		}
 		lock_protect(&z->lock, &z->rpz->local_zones, sizeof(*z->rpz));
-		lock_rw_wrlock(&az->rpz_lock);
+		/* the az->rpz_lock is locked above */
 		z->rpz_az_next = az->rpz_first;
 		if(az->rpz_first)
 			az->rpz_first->rpz_az_prev = z;
 		az->rpz_first = z;
+	}
+	if(c->isrpz) {
 		lock_rw_unlock(&az->rpz_lock);
 	}
 
diff --git a/services/cache/dns.c b/services/cache/dns.c
index 7b6e142c9..f3149b614 100644
--- a/services/cache/dns.c
+++ b/services/cache/dns.c
@@ -890,9 +890,8 @@ dns_cache_lookup(struct module_env* env,
 		lock_rw_unlock(&rrset->entry.lock);
 	}
 
-	/* construct DS, DNSKEY, DLV messages from rrset cache. */
-	if((qtype == LDNS_RR_TYPE_DS || qtype == LDNS_RR_TYPE_DNSKEY ||
-		qtype == LDNS_RR_TYPE_DLV) &&
+	/* construct DS, DNSKEY messages from rrset cache. */
+	if((qtype == LDNS_RR_TYPE_DS || qtype == LDNS_RR_TYPE_DNSKEY) &&
 		(rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen, 
 		qtype, qclass, 0, now, 0))) {
 		/* if the rrset is from the additional section, and the
diff --git a/services/listen_dnsport.c b/services/listen_dnsport.c
index 7833497b1..3a98c2642 100644
--- a/services/listen_dnsport.c
+++ b/services/listen_dnsport.c
@@ -71,6 +71,13 @@
 #include <systemd/sd-daemon.h>
 #endif
 
+#ifdef HAVE_IFADDRS_H
+#include <ifaddrs.h>
+#endif
+#ifdef HAVE_NET_IF_H
+#include <net/if.h>
+#endif
+
 /** number of queued TCP connections for listen() */
 #define TCP_BACKLOG 256 
 
@@ -234,16 +241,14 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 			*noproto = 1;
 			return -1;
 		}
-		log_err("can't create socket: %s", strerror(errno));
 #else
 		if(WSAGetLastError() == WSAEAFNOSUPPORT || 
 			WSAGetLastError() == WSAEPROTONOSUPPORT) {
 			*noproto = 1;
 			return -1;
 		}
-		log_err("can't create socket: %s", 
-			wsa_strerror(WSAGetLastError()));
 #endif
+		log_err("can't create socket: %s", sock_strerror(errno));
 		*noproto = 0;
 		return -1;
 	}
@@ -256,9 +261,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 #ifdef SO_REUSEADDR
 		if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on, 
 			(socklen_t)sizeof(on)) < 0) {
-#ifndef USE_WINSOCK
 			log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
-				strerror(errno));
+				sock_strerror(errno));
+#ifndef USE_WINSOCK
 			if(errno != ENOSYS) {
 				close(s);
 				*noproto = 0;
@@ -266,8 +271,6 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 				return -1;
 			}
 #else
-			log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
-				wsa_strerror(WSAGetLastError()));
 			closesocket(s);
 			*noproto = 0;
 			*inuse = 0;
@@ -359,16 +362,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		if(setsockopt(s, SOL_SOCKET, SO_RCVBUFFORCE, (void*)&rcv, 
 			(socklen_t)sizeof(rcv)) < 0) {
 			if(errno != EPERM) {
-#    ifndef USE_WINSOCK
 				log_err("setsockopt(..., SO_RCVBUFFORCE, "
-					"...) failed: %s", strerror(errno));
-				close(s);
-#    else
-				log_err("setsockopt(..., SO_RCVBUFFORCE, "
-					"...) failed: %s", 
-					wsa_strerror(WSAGetLastError()));
-				closesocket(s);
-#    endif
+					"...) failed: %s", sock_strerror(errno));
+				sock_close(s);
 				*noproto = 0;
 				*inuse = 0;
 				return -1;
@@ -376,16 +372,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 #  endif /* SO_RCVBUFFORCE */
 			if(setsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&rcv, 
 				(socklen_t)sizeof(rcv)) < 0) {
-#  ifndef USE_WINSOCK
 				log_err("setsockopt(..., SO_RCVBUF, "
-					"...) failed: %s", strerror(errno));
-				close(s);
-#  else
-				log_err("setsockopt(..., SO_RCVBUF, "
-					"...) failed: %s", 
-					wsa_strerror(WSAGetLastError()));
-				closesocket(s);
-#  endif
+					"...) failed: %s", sock_strerror(errno));
+				sock_close(s);
 				*noproto = 0;
 				*inuse = 0;
 				return -1;
@@ -418,16 +407,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		if(setsockopt(s, SOL_SOCKET, SO_SNDBUFFORCE, (void*)&snd, 
 			(socklen_t)sizeof(snd)) < 0) {
 			if(errno != EPERM) {
-#    ifndef USE_WINSOCK
 				log_err("setsockopt(..., SO_SNDBUFFORCE, "
-					"...) failed: %s", strerror(errno));
-				close(s);
-#    else
-				log_err("setsockopt(..., SO_SNDBUFFORCE, "
-					"...) failed: %s", 
-					wsa_strerror(WSAGetLastError()));
-				closesocket(s);
-#    endif
+					"...) failed: %s", sock_strerror(errno));
+				sock_close(s);
 				*noproto = 0;
 				*inuse = 0;
 				return -1;
@@ -435,16 +417,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 #  endif /* SO_SNDBUFFORCE */
 			if(setsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&snd, 
 				(socklen_t)sizeof(snd)) < 0) {
-#  ifndef USE_WINSOCK
 				log_err("setsockopt(..., SO_SNDBUF, "
-					"...) failed: %s", strerror(errno));
-				close(s);
-#  else
-				log_err("setsockopt(..., SO_SNDBUF, "
-					"...) failed: %s", 
-					wsa_strerror(WSAGetLastError()));
-				closesocket(s);
-#  endif
+					"...) failed: %s", sock_strerror(errno));
+				sock_close(s);
 				*noproto = 0;
 				*inuse = 0;
 				return -1;
@@ -474,16 +449,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 			int val=(v6only==2)?0:1;
 			if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, 
 				(void*)&val, (socklen_t)sizeof(val)) < 0) {
-#ifndef USE_WINSOCK
 				log_err("setsockopt(..., IPV6_V6ONLY"
-					", ...) failed: %s", strerror(errno));
-				close(s);
-#else
-				log_err("setsockopt(..., IPV6_V6ONLY"
-					", ...) failed: %s", 
-					wsa_strerror(WSAGetLastError()));
-				closesocket(s);
-#endif
+					", ...) failed: %s", sock_strerror(errno));
+				sock_close(s);
 				*noproto = 0;
 				*inuse = 0;
 				return -1;
@@ -501,16 +469,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		 */
 		if (setsockopt(s, IPPROTO_IPV6, IPV6_USE_MIN_MTU,
 			(void*)&on, (socklen_t)sizeof(on)) < 0) {
-#  ifndef USE_WINSOCK
 			log_err("setsockopt(..., IPV6_USE_MIN_MTU, "
-				"...) failed: %s", strerror(errno));
-			close(s);
-#  else
-			log_err("setsockopt(..., IPV6_USE_MIN_MTU, "
-				"...) failed: %s", 
-				wsa_strerror(WSAGetLastError()));
-			closesocket(s);
-#  endif
+				"...) failed: %s", sock_strerror(errno));
+			sock_close(s);
 			*noproto = 0;
 			*inuse = 0;
 			return -1;
@@ -523,15 +484,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		 */
 		if (setsockopt(s, IPPROTO_IPV6, IPV6_MTU,
 			(void*)&mtu, (socklen_t)sizeof(mtu)) < 0) {
-#  ifndef USE_WINSOCK
 			log_err("setsockopt(..., IPV6_MTU, ...) failed: %s", 
-				strerror(errno));
-			close(s);
-#  else
-			log_err("setsockopt(..., IPV6_MTU, ...) failed: %s", 
-				wsa_strerror(WSAGetLastError()));
-			closesocket(s);
-#  endif
+				sock_strerror(errno));
+			sock_close(s);
 			*noproto = 0;
 			*inuse = 0;
 			return -1;
@@ -555,12 +510,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 			if (errno != EINVAL) {
 				log_err("setsockopt(..., IP_MTU_DISCOVER, IP_PMTUDISC_OMIT...) failed: %s",
 					strerror(errno));
-
-#    ifndef USE_WINSOCK
-				close(s);
-#    else
-				closesocket(s);
-#    endif
+				sock_close(s);
 				*noproto = 0;
 				*inuse = 0;
 				return -1;
@@ -577,11 +527,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 				&action, (socklen_t)sizeof(action)) < 0) {
 				log_err("setsockopt(..., IP_MTU_DISCOVER, IP_PMTUDISC_DONT...) failed: %s",
 					strerror(errno));
-#    ifndef USE_WINSOCK
-				close(s);
-#    else
-				closesocket(s);
-#    endif
+				sock_close(s);
 				*noproto = 0;
 				*inuse = 0;
 				return -1;
@@ -593,11 +539,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 			&off, (socklen_t)sizeof(off)) < 0) {
 			log_err("setsockopt(..., IP_DONTFRAG, ...) failed: %s",
 				strerror(errno));
-#    ifndef USE_WINSOCK
-			close(s);
-#    else
-			closesocket(s);
-#    endif
+			sock_close(s);
 			*noproto = 0;
 			*inuse = 0;
 			return -1;
@@ -627,7 +569,6 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 				(struct sockaddr_storage*)addr, addrlen);
 		}
 #endif /* EADDRINUSE */
-		close(s);
 #else /* USE_WINSOCK */
 		if(WSAGetLastError() != WSAEADDRINUSE &&
 			WSAGetLastError() != WSAEADDRNOTAVAIL &&
@@ -636,18 +577,14 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 				wsa_strerror(WSAGetLastError()),
 				(struct sockaddr_storage*)addr, addrlen);
 		}
-		closesocket(s);
 #endif /* USE_WINSOCK */
+		sock_close(s);
 		return -1;
 	}
 	if(!fd_set_nonblock(s)) {
 		*noproto = 0;
 		*inuse = 0;
-#ifndef USE_WINSOCK
-		close(s);
-#else
-		closesocket(s);
-#endif
+		sock_close(s);
 		return -1;
 	}
 	return s;
@@ -692,16 +629,14 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 			*noproto = 1;
 			return -1;
 		}
-		log_err("can't create socket: %s", strerror(errno));
 #else
 		if(WSAGetLastError() == WSAEAFNOSUPPORT ||
 			WSAGetLastError() == WSAEPROTONOSUPPORT) {
 			*noproto = 1;
 			return -1;
 		}
-		log_err("can't create socket: %s", 
-			wsa_strerror(WSAGetLastError()));
 #endif
+		log_err("can't create socket: %s", sock_strerror(errno));
 		return -1;
 	}
 	if(nodelay) {
@@ -724,13 +659,8 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 #if defined(IPPROTO_TCP) && defined(TCP_MAXSEG)
 		if(setsockopt(s, IPPROTO_TCP, TCP_MAXSEG, (void*)&mss,
 			(socklen_t)sizeof(mss)) < 0) {
-			#ifndef USE_WINSOCK
 			log_err(" setsockopt(.. TCP_MAXSEG ..) failed: %s",
-				strerror(errno));
-			#else
-			log_err(" setsockopt(.. TCP_MAXSEG ..) failed: %s",
-				wsa_strerror(WSAGetLastError()));
-			#endif
+				sock_strerror(errno));
 		} else {
 			verbose(VERB_ALGO,
 				" tcp socket mss set to %d", mss);
@@ -747,15 +677,9 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 #ifdef SO_REUSEADDR
 	if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on, 
 		(socklen_t)sizeof(on)) < 0) {
-#ifndef USE_WINSOCK
 		log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
-			strerror(errno));
-		close(s);
-#else
-		log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
-			wsa_strerror(WSAGetLastError()));
-		closesocket(s);
-#endif
+			sock_strerror(errno));
+		sock_close(s);
 		return -1;
 	}
 #endif /* SO_REUSEADDR */
@@ -790,15 +714,9 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 	if(addr->ai_family == AF_INET6 && v6only) {
 		if(setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, 
 			(void*)&on, (socklen_t)sizeof(on)) < 0) {
-#ifndef USE_WINSOCK
 			log_err("setsockopt(..., IPV6_V6ONLY, ...) failed: %s",
-				strerror(errno));
-			close(s);
-#else
-			log_err("setsockopt(..., IPV6_V6ONLY, ...) failed: %s",
-				wsa_strerror(WSAGetLastError()));
-			closesocket(s);
-#endif
+				sock_strerror(errno));
+			sock_close(s);
 			return -1;
 		}
 	}
@@ -845,32 +763,22 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 				(struct sockaddr_storage*)addr->ai_addr,
 				addr->ai_addrlen);
 		}
-		close(s);
 #else
 		log_err_addr("can't bind socket", 
 			wsa_strerror(WSAGetLastError()),
 			(struct sockaddr_storage*)addr->ai_addr,
 			addr->ai_addrlen);
-		closesocket(s);
 #endif
+		sock_close(s);
 		return -1;
 	}
 	if(!fd_set_nonblock(s)) {
-#ifndef USE_WINSOCK
-		close(s);
-#else
-		closesocket(s);
-#endif
+		sock_close(s);
 		return -1;
 	}
 	if(listen(s, TCP_BACKLOG) == -1) {
-#ifndef USE_WINSOCK
-		log_err("can't listen: %s", strerror(errno));
-		close(s);
-#else
-		log_err("can't listen: %s", wsa_strerror(WSAGetLastError()));
-		closesocket(s);
-#endif
+		log_err("can't listen: %s", sock_strerror(errno));
+		sock_close(s);
 		return -1;
 	}
 #ifdef USE_TCP_FASTOPEN
@@ -925,34 +833,6 @@ set_ip_dscp(int socket, int addrfamily, int dscp)
 	return NULL;
 }
 
-#  ifndef USE_WINSOCK
-char*
-sock_strerror(int errn)
-{
-	return strerror(errn);
-}
-
-void
-sock_close(int socket)
-{
-	close(socket);
-}
-
-#  else
-char*
-sock_strerror(int ATTR_UNUSED(errn))
-{
-	return wsa_strerror(WSAGetLastError());
-}
-
-void
-sock_close(int socket)
-{
-	closesocket(socket);
-}
-
-#  endif /* USE_WINSOCK */
-
 int
 create_local_accept_sock(const char *path, int* noproto, int use_systemd)
 {
@@ -1013,11 +893,7 @@ create_local_accept_sock(const char *path, int* noproto, int use_systemd)
 	return s;
 
 err:
-#ifndef USE_WINSOCK
-	close(s);
-#else
-	closesocket(s);
-#endif
+	sock_close(s);
 	return -1;
 
 #ifdef HAVE_SYSTEMD
@@ -1289,20 +1165,12 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 		}
 		/* getting source addr packet info is highly non-portable */
 		if(!set_recvpktinfo(s, hints->ai_family)) {
-#ifndef USE_WINSOCK
-			close(s);
-#else
-			closesocket(s);
-#endif
+			sock_close(s);
 			return 0;
 		}
 		if(!port_insert(list, s,
 		   is_dnscrypt?listen_type_udpancil_dnscrypt:listen_type_udpancil)) {
-#ifndef USE_WINSOCK
-			close(s);
-#else
-			closesocket(s);
-#endif
+			sock_close(s);
 			return 0;
 		}
 	} else if(do_udp) {
@@ -1318,11 +1186,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 		}
 		if(!port_insert(list, s,
 		   is_dnscrypt?listen_type_udp_dnscrypt:listen_type_udp)) {
-#ifndef USE_WINSOCK
-			close(s);
-#else
-			closesocket(s);
-#endif
+			sock_close(s);
 			return 0;
 		}
 	}
@@ -1350,11 +1214,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 		if(is_ssl)
 			verbose(VERB_ALGO, "setup TCP for SSL service");
 		if(!port_insert(list, s, port_type)) {
-#ifndef USE_WINSOCK
-			close(s);
-#else
-			closesocket(s);
-#endif
+			sock_close(s);
 			return 0;
 		}
 	}
@@ -1537,8 +1397,163 @@ listen_delete(struct listen_dnsport* front)
 	}
 }
 
+#ifdef HAVE_GETIFADDRS
+static int
+resolve_ifa_name(struct ifaddrs *ifas, const char *search_ifa, char ***ip_addresses, int *ip_addresses_size)
+{
+	struct ifaddrs *ifa;
+	int last_ip_addresses_size = *ip_addresses_size;
+
+	for(ifa = ifas; ifa != NULL; ifa = ifa->ifa_next) {
+		sa_family_t family;
+		const char* atsign;
+#ifdef INET6      /* |   address ip    | % |  ifa name  | @ |  port  | nul */
+		char addr_buf[INET6_ADDRSTRLEN + 1 + IF_NAMESIZE + 1 + 16 + 1];
+#else
+		char addr_buf[INET_ADDRSTRLEN + 1 + 16 + 1];
+#endif
+
+		if((atsign=strrchr(search_ifa, '@')) != NULL) {
+			if(strlen(ifa->ifa_name) != (size_t)(atsign-search_ifa)
+			   || strncmp(ifa->ifa_name, search_ifa,
+			   atsign-search_ifa) != 0)
+				continue;
+		} else {
+			if(strcmp(ifa->ifa_name, search_ifa) != 0)
+				continue;
+			atsign = "";
+		}
+
+		if(ifa->ifa_addr == NULL)
+			continue;
+
+		family = ifa->ifa_addr->sa_family;
+		if(family == AF_INET) {
+			char a4[INET_ADDRSTRLEN + 1];
+			struct sockaddr_in *in4 = (struct sockaddr_in *)
+				ifa->ifa_addr;
+			if(!inet_ntop(family, &in4->sin_addr, a4, sizeof(a4))) {
+				log_err("inet_ntop failed");
+				return 0;
+			}
+			snprintf(addr_buf, sizeof(addr_buf), "%s%s",
+				a4, atsign);
+		}
+#ifdef INET6
+		else if(family == AF_INET6) {
+			struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)
+				ifa->ifa_addr;
+			char a6[INET6_ADDRSTRLEN + 1];
+			char if_index_name[IF_NAMESIZE + 1];
+			if_index_name[0] = 0;
+			if(!inet_ntop(family, &in6->sin6_addr, a6, sizeof(a6))) {
+				log_err("inet_ntop failed");
+				return 0;
+			}
+			if_indextoname(in6->sin6_scope_id,
+				(char *)if_index_name);
+			if (strlen(if_index_name) != 0) {
+				snprintf(addr_buf, sizeof(addr_buf),
+					"%s%%%s%s", a6, if_index_name, atsign);
+			} else {
+				snprintf(addr_buf, sizeof(addr_buf), "%s%s",
+					a6, atsign);
+			}
+		}
+#endif
+		else {
+			continue;
+		}
+		verbose(4, "interface %s has address %s", search_ifa, addr_buf);
+
+		*ip_addresses = realloc(*ip_addresses, sizeof(char *) * (*ip_addresses_size + 1));
+		if(!*ip_addresses) {
+			log_err("realloc failed: out of memory");
+			return 0;
+		}
+		(*ip_addresses)[*ip_addresses_size] = strdup(addr_buf);
+		if(!(*ip_addresses)[*ip_addresses_size]) {
+			log_err("strdup failed: out of memory");
+			return 0;
+		}
+		(*ip_addresses_size)++;
+	}
+
+	if (*ip_addresses_size == last_ip_addresses_size) {
+		*ip_addresses = realloc(*ip_addresses, sizeof(char *) * (*ip_addresses_size + 1));
+		if(!*ip_addresses) {
+			log_err("realloc failed: out of memory");
+			return 0;
+		}
+		(*ip_addresses)[*ip_addresses_size] = strdup(search_ifa);
+		if(!(*ip_addresses)[*ip_addresses_size]) {
+			log_err("strdup failed: out of memory");
+			return 0;
+		}
+		(*ip_addresses_size)++;
+	}
+	return 1;
+}
+#endif /* HAVE_GETIFADDRS */
+
+int resolve_interface_names(struct config_file* cfg, char*** resif,
+	int* num_resif)
+{
+#ifdef HAVE_GETIFADDRS
+	int i;
+	struct ifaddrs *addrs = NULL;
+	if(cfg->num_ifs == 0) {
+		*resif = NULL;
+		*num_resif = 0;
+		return 1;
+	}
+	if(getifaddrs(&addrs) == -1) {
+		log_err("failed to list interfaces: getifaddrs: %s",
+			strerror(errno));
+		freeifaddrs(addrs);
+		return 0;
+	}
+	for(i=0; i<cfg->num_ifs; i++) {
+		if(!resolve_ifa_name(addrs, cfg->ifs[i], resif, num_resif)) {
+			freeifaddrs(addrs);
+			config_del_strarray(*resif, *num_resif);
+			*resif = NULL;
+			*num_resif = 0;
+			return 0;
+		}
+	}
+	freeifaddrs(addrs);
+	return 1;
+#else
+	int i;
+	if(cfg->num_ifs == 0) {
+		*resif = NULL;
+		*num_resif = 0;
+		return 1;
+	}
+	*num_resif = cfg->num_ifs;
+	*resif = calloc(*num_resif, sizeof(**resif));
+	if(!*resif) {
+		log_err("out of memory");
+		return 0;
+	}
+	for(i=0; i<*num_resif; i++) {
+		(*resif)[i] = strdup(cfg->ifs[i]);
+		if(!((*resif)[i])) {
+			log_err("out of memory");
+			config_del_strarray(*resif, *num_resif);
+			*resif = NULL;
+			*num_resif = 0;
+			return 0;
+		}
+	}
+	return 1;
+#endif /* HAVE_GETIFADDRS */
+}
+
 struct listen_port* 
-listening_ports_open(struct config_file* cfg, int* reuseport)
+listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs,
+	int* reuseport)
 {
 	struct listen_port* list = NULL;
 	struct addrinfo hints;
@@ -1557,7 +1572,7 @@ listening_ports_open(struct config_file* cfg, int* reuseport)
 	memset(&hints, 0, sizeof(hints));
 	hints.ai_flags = AI_PASSIVE;
 	/* no name lookups on our listening ports */
-	if(cfg->num_ifs > 0)
+	if(num_ifs > 0)
 		hints.ai_flags |= AI_NUMERICHOST;
 	hints.ai_family = AF_UNSPEC;
 #ifndef INET6
@@ -1567,7 +1582,7 @@ listening_ports_open(struct config_file* cfg, int* reuseport)
 		return NULL;
 	}
 	/* create ip4 and ip6 ports so that return addresses are nice. */
-	if(do_auto || cfg->num_ifs == 0) {
+	if(do_auto || num_ifs == 0) {
 		if(do_ip6) {
 			hints.ai_family = AF_INET6;
 			if(!ports_create_if(do_auto?"::0":"::1", 
@@ -1598,12 +1613,12 @@ listening_ports_open(struct config_file* cfg, int* reuseport)
 				return NULL;
 			}
 		}
-	} else for(i = 0; i<cfg->num_ifs; i++) {
-		if(str_is_ip6(cfg->ifs[i])) {
+	} else for(i = 0; i<num_ifs; i++) {
+		if(str_is_ip6(ifs[i])) {
 			if(!do_ip6)
 				continue;
 			hints.ai_family = AF_INET6;
-			if(!ports_create_if(cfg->ifs[i], 0, cfg->do_udp, 
+			if(!ports_create_if(ifs[i], 0, cfg->do_udp,
 				do_tcp, &hints, portbuf, &list, 
 				cfg->so_rcvbuf, cfg->so_sndbuf,
 				cfg->ssl_port, cfg->tls_additional_port,
@@ -1618,7 +1633,7 @@ listening_ports_open(struct config_file* cfg, int* reuseport)
 			if(!do_ip4)
 				continue;
 			hints.ai_family = AF_INET;
-			if(!ports_create_if(cfg->ifs[i], 0, cfg->do_udp, 
+			if(!ports_create_if(ifs[i], 0, cfg->do_udp,
 				do_tcp, &hints, portbuf, &list, 
 				cfg->so_rcvbuf, cfg->so_sndbuf,
 				cfg->ssl_port, cfg->tls_additional_port,
@@ -1640,11 +1655,7 @@ void listening_ports_free(struct listen_port* list)
 	while(list) {
 		nx = list->next;
 		if(list->fd != -1) {
-#ifndef USE_WINSOCK
-			close(list->fd);
-#else
-			closesocket(list->fd);
-#endif
+			sock_close(list->fd);
 		}
 		free(list);
 		list = nx;
diff --git a/services/listen_dnsport.h b/services/listen_dnsport.h
index 0b1d90f33..4bbde0691 100644
--- a/services/listen_dnsport.h
+++ b/services/listen_dnsport.h
@@ -121,19 +121,32 @@ struct listen_port {
  * interfaces for IP4 and/or IP6, for UDP and/or TCP.
  * On the given port number. It creates the sockets.
  * @param cfg: settings on what ports to open.
+ * @param ifs: interfaces to open, array of IP addresses, "ip[@port]".
+ * @param num_ifs: length of ifs.
  * @param reuseport: set to true if you want reuseport, or NULL to not have it,
  *   set to false on exit if reuseport failed to apply (because of no
  *   kernel support).
  * @return: linked list of ports or NULL on error.
  */
 struct listen_port* listening_ports_open(struct config_file* cfg,
-	int* reuseport);
+	char** ifs, int num_ifs, int* reuseport);
 
 /**
  * Close and delete the (list of) listening ports.
  */
 void listening_ports_free(struct listen_port* list);
 
+/**
+ * Resolve interface names in config and store result IP addresses
+ * @param cfg: config
+ * @param resif: string array (malloced array of malloced strings) with
+ * 	result.  NULL if cfg has none.
+ * @param num_resif: length of resif.  Zero if cfg has zero num_ifs.
+ * @return 0 on failure.
+ */
+int resolve_interface_names(struct config_file* cfg, char*** resif,
+	int* num_resif);
+
 /**
  * Create commpoints with for this thread for the shared ports.
  * @param base: the comm_base that provides event functionality.
@@ -408,6 +421,5 @@ int http2_submit_dns_response(void* v);
 #endif /* HAVE_NGHTTP2 */
 
 char* set_ip_dscp(int socket, int addrfamily, int ds);
-char* sock_strerror(int errn);
 
 #endif /* LISTEN_DNSPORT_H */
diff --git a/services/mesh.c b/services/mesh.c
index ffb6d092a..52ff97e4a 100644
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -1306,7 +1306,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 
 void mesh_query_done(struct mesh_state* mstate)
 {
-	struct mesh_reply* r, *reply_list = NULL;
+	struct mesh_reply* r;
 	struct mesh_reply* prev = NULL;
 	struct sldns_buffer* prev_buffer = NULL;
 	struct mesh_cb* c;
@@ -1330,27 +1330,7 @@ void mesh_query_done(struct mesh_state* mstate)
 			free(err);
 		}
 	}
-	if(mstate->reply_list) {
-		/* set the reply_list to NULL during the mesh_query_done
-		 * processing, so that calls back into the mesh from
-		 * tcp_req_info (deciding to drop the reply and thus
-		 * unregister the mesh_reply from the mstate) are stopped
-		 * because the list is empty.
-		 * The mstate is then likely not a reply_state, and maybe
-		 * also a detached_state.
-		 */
-		reply_list = mstate->reply_list;
-		mstate->reply_list = NULL;
-		if(!mstate->reply_list && !mstate->cb_list) {
-			/* was a reply state, not anymore */
-			log_assert(mstate->s.env->mesh->num_reply_states > 0);
-			mstate->s.env->mesh->num_reply_states--;
-		}
-		if(!mstate->reply_list && !mstate->cb_list &&
-			mstate->super_set.count == 0)
-			mstate->s.env->mesh->num_detached_states++;
-	}
-	for(r = reply_list; r; r = r->next) {
+	for(r = mstate->reply_list; r; r = r->next) {
 		/* if a response-ip address block has been stored the
 		 *  information should be logged for each client. */
 		if(mstate->s.respip_action_info &&
@@ -1374,15 +1354,31 @@ void mesh_query_done(struct mesh_state* mstate)
 		/* if this query is determined to be dropped during the
 		 * mesh processing, this is the point to take that action. */
 		if(mstate->s.is_drop) {
+			/* briefly set the reply_list to NULL, so that the
+			 * tcp req info cleanup routine that calls the mesh
+			 * to deregister the meshstate for it is not done
+			 * because the list is NULL and also accounting is not
+			 * done there, but instead we do that here. */
+			struct mesh_reply* reply_list = mstate->reply_list;
+			mstate->reply_list = NULL;
 			comm_point_drop_reply(&r->query_reply);
+			mstate->reply_list = reply_list;
 		} else {
 			struct sldns_buffer* r_buffer = r->query_reply.c->buffer;
+			struct mesh_reply* rlist = mstate->reply_list;
 			if(r->query_reply.c->tcp_req_info) {
 				r_buffer = r->query_reply.c->tcp_req_info->spool_buffer;
 				prev_buffer = NULL;
 			}
+			/* briefly set the replylist to null in case the
+			 * meshsendreply calls tcpreqinfo sendreply that
+			 * comm_point_drops because of size, and then the
+			 * null stops the mesh state remove and thus
+			 * reply_list modification and accounting */
+			mstate->reply_list = NULL;
 			mesh_send_reply(mstate, mstate->s.return_rcode, rep,
 				r, r_buffer, prev, prev_buffer);
+			mstate->reply_list = rlist;
 			if(r->query_reply.c->tcp_req_info) {
 				tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate);
 				r_buffer = NULL;
@@ -1391,6 +1387,17 @@ void mesh_query_done(struct mesh_state* mstate)
 			prev_buffer = r_buffer;
 		}
 	}
+	if(mstate->reply_list) {
+		mstate->reply_list = NULL;
+		if(!mstate->reply_list && !mstate->cb_list) {
+			/* was a reply state, not anymore */
+			log_assert(mstate->s.env->mesh->num_reply_states > 0);
+			mstate->s.env->mesh->num_reply_states--;
+		}
+		if(!mstate->reply_list && !mstate->cb_list &&
+			mstate->super_set.count == 0)
+			mstate->s.env->mesh->num_detached_states++;
+	}
 	mstate->replies_sent = 1;
 	while((c = mstate->cb_list) != NULL) {
 		/* take this cb off the list; so that the list can be
@@ -1887,7 +1894,7 @@ mesh_serve_expired_callback(void* arg)
 {
 	struct mesh_state* mstate = (struct mesh_state*) arg;
 	struct module_qstate* qstate = &mstate->s;
-	struct mesh_reply* r;
+	struct mesh_reply* r, *rlist;
 	struct mesh_area* mesh = qstate->env->mesh;
 	struct dns_msg* msg;
 	struct mesh_cb* c;
@@ -1970,16 +1977,7 @@ mesh_serve_expired_callback(void* arg)
 	if(verbosity >= VERB_ALGO)
 		log_dns_msg("Serve expired lookup", &qstate->qinfo, msg->rep);
 
-	r = mstate->reply_list;
-	mstate->reply_list = NULL;
-	if(!mstate->reply_list && !mstate->cb_list && r) {
-		log_assert(mesh->num_reply_states > 0);
-		mesh->num_reply_states--;
-		if(mstate->super_set.count == 0) {
-			mesh->num_detached_states++;
-		}
-	}
-	for(; r; r = r->next) {
+	for(r = mstate->reply_list; r; r = r->next) {
 		/* If address info is returned, it means the action should be an
 		* 'inform' variant and the information should be logged. */
 		if(actinfo.addrinfo) {
@@ -2001,8 +1999,15 @@ mesh_serve_expired_callback(void* arg)
 		r_buffer = r->query_reply.c->buffer;
 		if(r->query_reply.c->tcp_req_info)
 			r_buffer = r->query_reply.c->tcp_req_info->spool_buffer;
+		/* briefly set the replylist to null in case the meshsendreply
+		 * calls tcpreqinfo sendreply that comm_point_drops because
+		 * of size, and then the null stops the mesh state remove and
+		 * thus reply_list modification and accounting */
+		rlist = mstate->reply_list;
+		mstate->reply_list = NULL;
 		mesh_send_reply(mstate, LDNS_RCODE_NOERROR, msg->rep,
 			r, r_buffer, prev, prev_buffer);
+		mstate->reply_list = rlist;
 		if(r->query_reply.c->tcp_req_info)
 			tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate);
 		prev = r;
@@ -2012,6 +2017,16 @@ mesh_serve_expired_callback(void* arg)
 		mesh->ans_expired++;
 
 	}
+	if(mstate->reply_list) {
+		mstate->reply_list = NULL;
+		if(!mstate->reply_list && !mstate->cb_list) {
+			log_assert(mesh->num_reply_states > 0);
+			mesh->num_reply_states--;
+			if(mstate->super_set.count == 0) {
+				mesh->num_detached_states++;
+			}
+		}
+	}
 	while((c = mstate->cb_list) != NULL) {
 		/* take this cb off the list; so that the list can be
 		 * changed, eg. by adds from the callback routine */
diff --git a/services/outside_network.c b/services/outside_network.c
index 44e01d745..085d0e6ae 100644
--- a/services/outside_network.c
+++ b/services/outside_network.c
@@ -58,6 +58,7 @@
 #include "util/net_help.h"
 #include "util/random.h"
 #include "util/fptr_wlist.h"
+#include "util/edns.h"
 #include "sldns/sbuffer.h"
 #include "dnstap/dnstap.h"
 #ifdef HAVE_OPENSSL_SSL_H
@@ -165,11 +166,7 @@ pick_outgoing_tcp(struct waiting_tcp* w, int s)
 	if(num == 0) {
 		log_err("no TCP outgoing interfaces of family");
 		log_addr(VERB_OPS, "for addr", &w->addr, w->addrlen);
-#ifndef USE_WINSOCK
-		close(s);
-#else
-		closesocket(s);
-#endif
+		sock_close(s);
 		return 0;
 	}
 #ifdef INET6
@@ -188,14 +185,8 @@ pick_outgoing_tcp(struct waiting_tcp* w, int s)
 		((struct sockaddr_in6*)&pi->addr)->sin6_port = 0;
 	else	((struct sockaddr_in*)&pi->addr)->sin_port = 0;
 	if(bind(s, (struct sockaddr*)&pi->addr, pi->addrlen) != 0) {
-#ifndef USE_WINSOCK
-		log_err("outgoing tcp: bind: %s", strerror(errno));
-		close(s);
-#else
-		log_err("outgoing tcp: bind: %s", 
-			wsa_strerror(WSAGetLastError()));
-		closesocket(s);
-#endif
+		log_err("outgoing tcp: bind: %s", sock_strerror(errno));
+		sock_close(s);
 		return 0;
 	}
 	log_addr(VERB_ALGO, "tcp bound to src", &pi->addr, pi->addrlen);
@@ -225,13 +216,8 @@ outnet_get_tcp_fd(struct sockaddr_storage* addr, socklen_t addrlen, int tcp_mss,
 		s = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
 	}
 	if(s == -1) {
-#ifndef USE_WINSOCK
-		log_err_addr("outgoing tcp: socket", strerror(errno),
+		log_err_addr("outgoing tcp: socket", sock_strerror(errno),
 			addr, addrlen);
-#else
-		log_err_addr("outgoing tcp: socket", 
-			wsa_strerror(WSAGetLastError()), addr, addrlen);
-#endif
 		return -1;
 	}
 
@@ -2111,9 +2097,20 @@ outnet_serviced_query(struct outside_network* outnet,
 {
 	struct serviced_query* sq;
 	struct service_callback* cb;
+	struct edns_tag_addr* client_tag_addr;
+
 	if(!inplace_cb_query_call(env, qinfo, flags, addr, addrlen, zone, zonelen,
 		qstate, qstate->region))
 			return NULL;
+
+	if((client_tag_addr = edns_tag_addr_lookup(&env->edns_tags->client_tags,
+		addr, addrlen))) {
+		uint16_t client_tag = htons(client_tag_addr->tag_data);
+		edns_opt_list_append(&qstate->edns_opts_back_out,
+			LDNS_EDNS_CLIENT_TAG, 2,
+			(uint8_t*)&client_tag, qstate->region);
+	}
+
 	serviced_gen_query(buff, qinfo->qname, qinfo->qname_len, qinfo->qtype,
 		qinfo->qclass, flags);
 	sq = lookup_serviced(outnet, buff, dnssec, addr, addrlen,
diff --git a/services/rpz.c b/services/rpz.c
index 105f238d0..ba5dd186d 100644
--- a/services/rpz.c
+++ b/services/rpz.c
@@ -597,8 +597,18 @@ rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname,
 	uint8_t* policydname;
 
 	if(!dname_subdomain_c(dname, azname)) {
-		log_err("RPZ: name of record to insert into RPZ is not a "
-			"subdomain of the configured name of the RPZ zone");
+		char* dname_str = sldns_wire2str_dname(dname, dnamelen);
+		char* azname_str = sldns_wire2str_dname(azname, aznamelen);
+		if(dname_str && azname_str) {
+			log_err("RPZ: name of record (%s) to insert into RPZ is not a "
+				"subdomain of the configured name of the RPZ zone (%s)",
+				dname_str, azname_str);
+		} else {
+			log_err("RPZ: name of record to insert into RPZ is not a "
+				"subdomain of the configured name of the RPZ zone");
+		}
+		free(dname_str);
+		free(azname_str);
 		return 0;
 	}
 
diff --git a/sldns/rrdef.h b/sldns/rrdef.h
index 4e7fef574..e084f354a 100644
--- a/sldns/rrdef.h
+++ b/sldns/rrdef.h
@@ -426,7 +426,8 @@ enum sldns_enum_edns_option
 	LDNS_EDNS_N3U = 7, /* RFC6975 */
 	LDNS_EDNS_CLIENT_SUBNET = 8, /* RFC7871 */
 	LDNS_EDNS_KEEPALIVE = 11, /* draft-ietf-dnsop-edns-tcp-keepalive*/
-	LDNS_EDNS_PADDING = 12 /* RFC7830 */
+	LDNS_EDNS_PADDING = 12, /* RFC7830 */
+	LDNS_EDNS_CLIENT_TAG = 16 /* draft-bellis-dnsop-edns-tags-01 */
 };
 typedef enum sldns_enum_edns_option sldns_edns_option;
 
diff --git a/smallapp/unbound-checkconf.c b/smallapp/unbound-checkconf.c
index 54a0ab78c..b1b7ae7ef 100644
--- a/smallapp/unbound-checkconf.c
+++ b/smallapp/unbound-checkconf.c
@@ -58,6 +58,7 @@
 #include "services/authzone.h"
 #include "respip/respip.h"
 #include "sldns/sbuffer.h"
+#include "sldns/str2wire.h"
 #ifdef HAVE_GETOPT_H
 #include <getopt.h>
 #endif
@@ -194,6 +195,94 @@ localzonechecks(struct config_file* cfg)
 	local_zones_delete(zs);
 }
 
+/** checks for acl and views */
+static void
+acl_view_tag_checks(struct config_file* cfg, struct views* views)
+{
+	int d;
+	struct sockaddr_storage a;
+	socklen_t alen;
+	struct config_str2list* acl;
+	struct config_str3list* s3;
+	struct config_strbytelist* sb;
+
+	/* acl_view */
+	for(acl=cfg->acl_view; acl; acl = acl->next) {
+		struct view* v;
+		if(!netblockstrtoaddr(acl->str, UNBOUND_DNS_PORT, &a, &alen,
+			&d)) {
+			fatal_exit("cannot parse access-control-view "
+				"address %s %s", acl->str, acl->str2);
+		}
+		v = views_find_view(views, acl->str2, 0);
+		if(!v) {
+			fatal_exit("cannot find view for "
+				"access-control-view: %s %s",
+				acl->str, acl->str2);
+		}
+		lock_rw_unlock(&v->lock);
+	}
+
+	/* acl_tags */
+	for(sb=cfg->acl_tags; sb; sb = sb->next) {
+		if(!netblockstrtoaddr(sb->str, UNBOUND_DNS_PORT, &a, &alen,
+			&d)) {
+			fatal_exit("cannot parse access-control-tags "
+				"address %s", sb->str);
+		}
+	}
+
+	/* acl_tag_actions */
+	for(s3=cfg->acl_tag_actions; s3; s3 = s3->next) {
+		enum localzone_type t;
+		if(!netblockstrtoaddr(s3->str, UNBOUND_DNS_PORT, &a, &alen,
+			&d)) {
+			fatal_exit("cannot parse access-control-tag-actions "
+				"address %s %s %s",
+				s3->str, s3->str2, s3->str3);
+		}
+		if(find_tag_id(cfg, s3->str2) == -1) {
+			fatal_exit("cannot parse tag %s (define-tag it), "
+				"for access-control-tag-actions: %s %s %s",
+				s3->str2, s3->str, s3->str2, s3->str3);
+		}
+		if(!local_zone_str2type(s3->str3, &t)) {
+			fatal_exit("cannot parse access control action type %s"
+				" for access-control-tag-actions: %s %s %s",
+				s3->str3, s3->str, s3->str2, s3->str3);
+		}
+	}
+
+	/* acl_tag_datas */
+	for(s3=cfg->acl_tag_datas; s3; s3 = s3->next) {
+		char buf[65536];
+		uint8_t rr[LDNS_RR_BUF_SIZE];
+		size_t len = sizeof(rr);
+		int res;
+		if(!netblockstrtoaddr(s3->str, UNBOUND_DNS_PORT, &a, &alen,
+			&d)) {
+			fatal_exit("cannot parse access-control-tag-datas address %s %s '%s'",
+				s3->str, s3->str2, s3->str3);
+		}
+		if(find_tag_id(cfg, s3->str2) == -1) {
+			fatal_exit("cannot parse tag %s (define-tag it), "
+				"for access-control-tag-datas: %s %s '%s'",
+				s3->str2, s3->str, s3->str2, s3->str3);
+		}
+		/* '.' is sufficient for validation, and it makes the call to
+		 * sldns_wirerr_get_type() simpler below. */
+		snprintf(buf, sizeof(buf), "%s %s", ".", s3->str3);
+		res = sldns_str2wire_rr_buf(buf, rr, &len, NULL, 3600, NULL,
+			0, NULL, 0);
+		if(res != 0) {
+			fatal_exit("cannot parse rr data [char %d] parse error %s, for access-control-tag-datas: %s %s '%s'",
+				(int)LDNS_WIREPARSE_OFFSET(res)-2,
+				sldns_get_errorstr_parse(res),
+				s3->str, s3->str2, s3->str3);
+		}
+	}
+}
+
 /** check view and response-ip configuration */
 static void
 view_and_respipchecks(struct config_file* cfg)
@@ -211,6 +300,7 @@ view_and_respipchecks(struct config_file* cfg)
 		fatal_exit("Could not setup respip set");
 	if(!respip_views_apply_cfg(views, cfg, &ignored))
 		fatal_exit("Could not setup per-view respip sets");
+	acl_view_tag_checks(cfg, views);
 	views_delete(views);
 	respip_set_delete(respip);
 }
@@ -534,8 +624,6 @@ morechecks(struct config_file* cfg)
 		cfg->auto_trust_anchor_file_list, cfg->chrootdir, cfg);
 	check_chroot_filelist_wild("trusted-keys-file",
 		cfg->trusted_keys_file_list, cfg->chrootdir, cfg);
-	check_chroot_string("dlv-anchor-file", &cfg->dlv_anchor_file,
-		cfg->chrootdir, cfg);
 #ifdef USE_IPSECMOD
 	if(cfg->ipsecmod_enabled && strstr(cfg->module_conf, "ipsecmod")) {
 		/* only check hook if enabled */
diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
index 3f3fb4f06..842dbe0d8 100644
--- a/smallapp/unbound-control.c
+++ b/smallapp/unbound-control.c
@@ -596,11 +596,7 @@ contact_server(const char* svr, struct config_file* cfg, int statuscmd)
 		addrfamily = addr_is_ip6(&addr, addrlen)?PF_INET6:PF_INET;
 	fd = socket(addrfamily, SOCK_STREAM, proto);
 	if(fd == -1) {
-#ifndef USE_WINSOCK
-		fatal_exit("socket: %s", strerror(errno));
-#else
-		fatal_exit("socket: %s", wsa_strerror(WSAGetLastError()));
-#endif
+		fatal_exit("socket: %s", sock_strerror(errno));
 	}
 	if(connect(fd, (struct sockaddr*)&addr, addrlen) < 0) {
 #ifndef USE_WINSOCK
@@ -684,11 +680,7 @@ remote_read(SSL* ssl, int fd, char* buf, size_t len)
 				/* EOF */
 				return 0;
 			}
-#ifndef USE_WINSOCK
-			fatal_exit("could not recv: %s", strerror(errno));
-#else
-			fatal_exit("could not recv: %s", wsa_strerror(WSAGetLastError()));
-#endif
+			fatal_exit("could not recv: %s", sock_strerror(errno));
 		}
 		buf[rr] = 0;
 	}
@@ -704,11 +696,7 @@ remote_write(SSL* ssl, int fd, const char* buf, size_t len)
 			ssl_err("could not SSL_write");
 	} else {
 		if(send(fd, buf, len, 0) < (ssize_t)len) {
-#ifndef USE_WINSOCK
-			fatal_exit("could not send: %s", strerror(errno));
-#else
-			fatal_exit("could not send: %s", wsa_strerror(WSAGetLastError()));
-#endif
+			fatal_exit("could not send: %s", sock_strerror(errno));
 		}
 	}
 }
@@ -827,11 +815,7 @@ go(const char* cfgfile, char* svr, int quiet, int argc, char* argv[])
 	ret = go_cmd(ssl, fd, quiet, argc, argv);
 
 	if(ssl) SSL_free(ssl);
-#ifndef USE_WINSOCK
-	close(fd);
-#else
-	closesocket(fd);
-#endif
+	sock_close(fd);
 	if(ctx) SSL_CTX_free(ctx);
 	config_delete(cfg);
 	return ret;
@@ -889,7 +873,7 @@ int main(int argc, char* argv[])
 	if(argc == 0)
 		usage();
 	if(argc >= 1 && strcmp(argv[0], "start")==0) {
-#if defined(TARGET_OS_TV) || defined(TARGET_OS_WATCH)
+#if (defined(TARGET_OS_TV) && TARGET_OS_TV) || (defined(TARGET_OS_WATCH) && TARGET_OS_WATCH)
 		fatal_exit("could not exec unbound: %s",
 			strerror(ENOSYS));
 #else
diff --git a/testcode/delayer.c b/testcode/delayer.c
index ebf883926..54175dbe3 100644
--- a/testcode/delayer.c
+++ b/testcode/delayer.c
@@ -372,11 +372,7 @@ service_send(struct ringbuf* ring, struct timeval* now, sldns_buffer* pkt,
 			sldns_buffer_limit(pkt), 0, 
 			(struct sockaddr*)srv_addr, srv_len);
 		if(sent == -1) {
-#ifndef USE_WINSOCK
-			log_err("sendto: %s", strerror(errno));
-#else
-			log_err("sendto: %s", wsa_strerror(WSAGetLastError()));
-#endif
+			log_err("sendto: %s", sock_strerror(errno));
 		} else if(sent != (ssize_t)sldns_buffer_limit(pkt)) {
 			log_err("sendto: partial send");
 		}
@@ -398,13 +394,12 @@ do_proxy(struct proxy* p, int retsock, sldns_buffer* pkt)
 #ifndef USE_WINSOCK
 			if(errno == EAGAIN || errno == EINTR)
 				return;
-			log_err("recv: %s", strerror(errno));
 #else
 			if(WSAGetLastError() == WSAEINPROGRESS ||
 				WSAGetLastError() == WSAEWOULDBLOCK)
 				return;
-			log_err("recv: %s", wsa_strerror(WSAGetLastError()));
 #endif
+			log_err("recv: %s", sock_strerror(errno));
 			return;
 		}
 		sldns_buffer_set_limit(pkt, (size_t)r);
@@ -414,11 +409,7 @@ do_proxy(struct proxy* p, int retsock, sldns_buffer* pkt)
 		r = sendto(retsock, (void*)sldns_buffer_begin(pkt), (size_t)r, 
 			0, (struct sockaddr*)&p->addr, p->addr_len);
 		if(r == -1) {
-#ifndef USE_WINSOCK
-			log_err("sendto: %s", strerror(errno));
-#else
-			log_err("sendto: %s", wsa_strerror(WSAGetLastError()));
-#endif
+			log_err("sendto: %s", sock_strerror(errno));
 		}
 	}
 }
@@ -469,11 +460,7 @@ find_create_proxy(struct sockaddr_storage* from, socklen_t from_len,
 	if(!p) fatal_exit("out of memory");
 	p->s = socket(serv_ip6?AF_INET6:AF_INET, SOCK_DGRAM, 0);
 	if(p->s == -1) {
-#ifndef USE_WINSOCK
-		fatal_exit("socket: %s", strerror(errno));
-#else
-		fatal_exit("socket: %s", wsa_strerror(WSAGetLastError()));
-#endif
+		fatal_exit("socket: %s", sock_strerror(errno));
 	}
 	fd_set_nonblock(p->s);
 	memmove(&p->addr, from, from_len);
@@ -507,14 +494,12 @@ service_recv(int s, struct ringbuf* ring, sldns_buffer* pkt,
 #ifndef USE_WINSOCK
 			if(errno == EAGAIN || errno == EINTR)
 				return;
-			fatal_exit("recvfrom: %s", strerror(errno));
 #else
 			if(WSAGetLastError() == WSAEWOULDBLOCK || 
 				WSAGetLastError() == WSAEINPROGRESS)
 				return;
-			fatal_exit("recvfrom: %s", 
-				wsa_strerror(WSAGetLastError()));
 #endif
+			fatal_exit("recvfrom: %s", sock_strerror(errno));
 		}
 		sldns_buffer_set_limit(pkt, (size_t)len);
 		/* find its proxy element */
@@ -550,15 +535,9 @@ tcp_proxy_delete(struct tcp_proxy* p)
 		free(s);
 		s = sn;
 	}
-#ifndef USE_WINSOCK
-	close(p->client_s);
+	sock_close(p->client_s);
 	if(p->server_s != -1)
-		close(p->server_s);
-#else
-	closesocket(p->client_s);
-	if(p->server_s != -1)
-		closesocket(p->server_s);
-#endif
+		sock_close(p->server_s);
 	free(p);
 }
 
@@ -577,14 +556,13 @@ service_tcp_listen(int s, fd_set* rorig, int* max, struct tcp_proxy** proxies,
 #ifndef USE_WINSOCK
 		if(errno == EAGAIN || errno == EINTR)
 			return;
-		fatal_exit("accept: %s", strerror(errno));
 #else
 		if(WSAGetLastError() == WSAEWOULDBLOCK || 
 			WSAGetLastError() == WSAEINPROGRESS ||
 			WSAGetLastError() == WSAECONNRESET)
 			return;
-		fatal_exit("accept: %s", wsa_strerror(WSAGetLastError()));
 #endif
+		fatal_exit("accept: %s", sock_strerror(errno));
 	}
 	p = (struct tcp_proxy*)calloc(1, sizeof(*p));
 	if(!p) fatal_exit("out of memory");
@@ -595,11 +573,7 @@ service_tcp_listen(int s, fd_set* rorig, int* max, struct tcp_proxy** proxies,
 	p->server_s = socket(addr_is_ip6(srv_addr, srv_len)?AF_INET6:AF_INET,
 		SOCK_STREAM, 0);
 	if(p->server_s == -1) {
-#ifndef USE_WINSOCK
-		fatal_exit("tcp socket: %s", strerror(errno));
-#else
-		fatal_exit("tcp socket: %s", wsa_strerror(WSAGetLastError()));
-#endif
+		fatal_exit("tcp socket: %s", sock_strerror(errno));
 	}
 	fd_set_nonblock(p->client_s);
 	fd_set_nonblock(p->server_s);
@@ -607,16 +581,14 @@ service_tcp_listen(int s, fd_set* rorig, int* max, struct tcp_proxy** proxies,
 #ifndef USE_WINSOCK
 		if(errno != EINPROGRESS) {
 			log_err("tcp connect: %s", strerror(errno));
-			close(p->server_s);
-			close(p->client_s);
 #else
 		if(WSAGetLastError() != WSAEWOULDBLOCK &&
 			WSAGetLastError() != WSAEINPROGRESS) {
 			log_err("tcp connect: %s", 
 				wsa_strerror(WSAGetLastError()));
-			closesocket(p->server_s);
-			closesocket(p->client_s);
 #endif
+			sock_close(p->server_s);
+			sock_close(p->client_s);
 			free(p);
 			return;
 		}
@@ -650,13 +622,12 @@ tcp_relay_read(int s, struct tcp_send_list** first,
 #ifndef USE_WINSOCK
 		if(errno == EINTR || errno == EAGAIN)
 			return 1;
-		log_err("tcp read: %s", strerror(errno));
 #else
 		if(WSAGetLastError() == WSAEINPROGRESS || 
 			WSAGetLastError() == WSAEWOULDBLOCK)
 			return 1;
-		log_err("tcp read: %s", wsa_strerror(WSAGetLastError()));
 #endif
+		log_err("tcp read: %s", sock_strerror(errno));
 		return 0;
 	} else if(r == 0) {
 		/* connection closed */
@@ -708,14 +679,12 @@ tcp_relay_write(int s, struct tcp_send_list** first,
 #ifndef USE_WINSOCK
 			if(errno == EAGAIN || errno == EINTR)
 				return 1;
-			log_err("tcp write: %s", strerror(errno));
 #else
 			if(WSAGetLastError() == WSAEWOULDBLOCK || 
 				WSAGetLastError() == WSAEINPROGRESS)
 				return 1;
-			log_err("tcp write: %s", 
-				wsa_strerror(WSAGetLastError()));
 #endif
+			log_err("tcp write: %s", sock_strerror(errno));
 			return 0;
 		} else if(r == 0) {
 			/* closed */
@@ -769,11 +738,7 @@ service_tcp_relay(struct tcp_proxy** tcp_proxies, struct timeval* now,
 			log_addr(1, "read tcp answer", &p->addr, p->addr_len);
 			if(!tcp_relay_read(p->server_s, &p->answerlist, 
 				&p->answerlast, now, delay, pkt)) {
-#ifndef USE_WINSOCK
-				close(p->server_s);
-#else
-				closesocket(p->server_s);
-#endif
+				sock_close(p->server_s);
 				FD_CLR(FD_SET_T p->server_s, worig);
 				FD_CLR(FD_SET_T p->server_s, rorig);
 				p->server_s = -1;
@@ -901,11 +866,7 @@ proxy_list_clear(struct proxy* p)
 			"%u returned\n", i++, from, port, (int)p->numreuse+1,
 			(unsigned)p->numwait, (unsigned)p->numsent, 
 			(unsigned)p->numreturn);
-#ifndef USE_WINSOCK
-		close(p->s);
-#else
-		closesocket(p->s);
-#endif
+		sock_close(p->s);
 		free(p);
 		p = np;
 	}
@@ -1034,11 +995,7 @@ service(const char* bind_str, int bindport, const char* serv_str,
 	/* bind UDP port */
 	if((s = socket(str_is_ip6(bind_str)?AF_INET6:AF_INET,
 		SOCK_DGRAM, 0)) == -1) {
-#ifndef USE_WINSOCK
-		fatal_exit("socket: %s", strerror(errno));
-#else
-		fatal_exit("socket: %s", wsa_strerror(WSAGetLastError()));
-#endif
+		fatal_exit("socket: %s", sock_strerror(errno));
 	}
 	i=0;
 	if(bindport == 0) {
@@ -1051,11 +1008,7 @@ service(const char* bind_str, int bindport, const char* serv_str,
 			exit(1);
 		}
 		if(bind(s, (struct sockaddr*)&bind_addr, bind_len) == -1) {
-#ifndef USE_WINSOCK
-			log_err("bind: %s", strerror(errno));
-#else
-			log_err("bind: %s", wsa_strerror(WSAGetLastError()));
-#endif
+			log_err("bind: %s", sock_strerror(errno));
 			if(i--==0)
 				fatal_exit("cannot bind any port");
 			bindport = 1024 + ((int)arc4random())%64000;
@@ -1065,39 +1018,22 @@ service(const char* bind_str, int bindport, const char* serv_str,
 	/* and TCP port */
 	if((listen_s = socket(str_is_ip6(bind_str)?AF_INET6:AF_INET,
 		SOCK_STREAM, 0)) == -1) {
-#ifndef USE_WINSOCK
-		fatal_exit("tcp socket: %s", strerror(errno));
-#else
-		fatal_exit("tcp socket: %s", wsa_strerror(WSAGetLastError()));
-#endif
+		fatal_exit("tcp socket: %s", sock_strerror(errno));
 	}
 #ifdef SO_REUSEADDR
 	if(1) {
 		int on = 1;
 		if(setsockopt(listen_s, SOL_SOCKET, SO_REUSEADDR, (void*)&on,
 			(socklen_t)sizeof(on)) < 0)
-#ifndef USE_WINSOCK
 			fatal_exit("setsockopt(.. SO_REUSEADDR ..) failed: %s",
-				strerror(errno));
-#else
-			fatal_exit("setsockopt(.. SO_REUSEADDR ..) failed: %s",
-				wsa_strerror(WSAGetLastError()));
-#endif
+				sock_strerror(errno));
 	}
 #endif
 	if(bind(listen_s, (struct sockaddr*)&bind_addr, bind_len) == -1) {
-#ifndef USE_WINSOCK
-		fatal_exit("tcp bind: %s", strerror(errno));
-#else
-		fatal_exit("tcp bind: %s", wsa_strerror(WSAGetLastError()));
-#endif
+		fatal_exit("tcp bind: %s", sock_strerror(errno));
 	}
 	if(listen(listen_s, 5) == -1) {
-#ifndef USE_WINSOCK
-		fatal_exit("tcp listen: %s", strerror(errno));
-#else
-		fatal_exit("tcp listen: %s", wsa_strerror(WSAGetLastError()));
-#endif
+		fatal_exit("tcp listen: %s", sock_strerror(errno));
 	}
 	fd_set_nonblock(listen_s);
 	printf("listening on port: %d\n", bindport);
@@ -1109,13 +1045,8 @@ service(const char* bind_str, int bindport, const char* serv_str,
 
 	/* cleanup */
 	verbose(1, "cleanup");
-#ifndef USE_WINSOCK
-	close(s);
-	close(listen_s);
-#else
-	closesocket(s);
-	closesocket(listen_s);
-#endif
+	sock_close(s);
+	sock_close(listen_s);
 	sldns_buffer_free(pkt);
 	ring_delete(ring);
 }
diff --git a/testcode/fake_event.c b/testcode/fake_event.c
index d2d5bbe5c..674069afc 100644
--- a/testcode/fake_event.c
+++ b/testcode/fake_event.c
@@ -52,6 +52,7 @@
 #include "util/data/msgreply.h"
 #include "util/data/msgencode.h"
 #include "util/data/dname.h"
+#include "util/edns.h"
 #include "util/config_file.h"
 #include "services/listen_dnsport.h"
 #include "services/outside_network.h"
@@ -1183,7 +1184,7 @@ struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 	socklen_t addrlen, uint8_t* zone, size_t zonelen,
 	struct module_qstate* qstate, comm_point_callback_type* callback,
 	void* callback_arg, sldns_buffer* ATTR_UNUSED(buff),
-	struct module_env* ATTR_UNUSED(env))
+	struct module_env* env)
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)outnet->base;
 	struct fake_pending* pend = (struct fake_pending*)calloc(1,
@@ -1212,6 +1213,7 @@ struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 	sldns_buffer_flip(pend->buffer);
 	if(1) {
 		struct edns_data edns;
+		struct edns_tag_addr* client_tag_addr;
 		if(!inplace_cb_query_call(env, qinfo, flags, addr, addrlen,
 			zone, zonelen, qstate, qstate->region)) {
 			free(pend);
@@ -1223,9 +1225,17 @@ struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 		edns.edns_version = EDNS_ADVERTISED_VERSION;
 		edns.udp_size = EDNS_ADVERTISED_SIZE;
 		edns.bits = 0;
-		edns.opt_list = qstate->edns_opts_back_out;
 		if(dnssec)
 			edns.bits = EDNS_DO;
+		if((client_tag_addr = edns_tag_addr_lookup(
+			&env->edns_tags->client_tags,
+			addr, addrlen))) {
+			uint16_t client_tag = htons(client_tag_addr->tag_data);
+			edns_opt_list_append(&qstate->edns_opts_back_out,
+				LDNS_EDNS_CLIENT_TAG, 2,
+				(uint8_t*)&client_tag, qstate->region);
+		}
+		edns.opt_list = qstate->edns_opts_back_out;
 		attach_edns_record(pend->buffer, &edns);
 	}
 	memcpy(&pend->addr, addr, addrlen);
@@ -1293,7 +1303,14 @@ void outnet_serviced_query_stop(struct serviced_query* sq, void* cb_arg)
 	log_info("double delete of pending serviced query");
 }
 
+int resolve_interface_names(struct config_file* ATTR_UNUSED(cfg),
+	char*** ATTR_UNUSED(resif), int* ATTR_UNUSED(num_resif))
+{
+	return 1;
+}
+
 struct listen_port* listening_ports_open(struct config_file* ATTR_UNUSED(cfg),
+	char** ATTR_UNUSED(ifs), int ATTR_UNUSED(num_ifs),
 	int* ATTR_UNUSED(reuseport))
 {
 	return calloc(1, 1);
diff --git a/testcode/perf.c b/testcode/perf.c
index 5b170ca57..b13eca6d3 100644
--- a/testcode/perf.c
+++ b/testcode/perf.c
@@ -233,12 +233,7 @@ perfsetup(struct perfinfo* info)
 			addr_is_ip6(&info->dest, info->destlen)?
 			AF_INET6:AF_INET, SOCK_DGRAM, 0);
 		if(info->io[i].fd == -1) {
-#ifndef USE_WINSOCK
-			fatal_exit("socket: %s", strerror(errno));
-#else
-			fatal_exit("socket: %s", 
-				wsa_strerror(WSAGetLastError()));
-#endif
+			fatal_exit("socket: %s", sock_strerror(errno));
 		}
 		if(info->io[i].fd > info->maxfd)
 			info->maxfd = info->io[i].fd;
@@ -260,11 +255,7 @@ perffree(struct perfinfo* info)
 	if(!info) return;
 	if(info->io) {
 		for(i=0; i<info->io_num; i++) {
-#ifndef USE_WINSOCK
-			close(info->io[i].fd);
-#else
-			closesocket(info->io[i].fd);
-#endif
+			sock_close(info->io[i].fd);
 		}
 		free(info->io);
 	}
@@ -285,11 +276,7 @@ perfsend(struct perfinfo* info, size_t n, struct timeval* now)
 	/*log_hex("send", info->qlist_data[info->qlist_idx],
 		info->qlist_len[info->qlist_idx]);*/
 	if(r == -1) {
-#ifndef USE_WINSOCK
-		log_err("sendto: %s", strerror(errno));
-#else
-		log_err("sendto: %s", wsa_strerror(WSAGetLastError()));
-#endif
+		log_err("sendto: %s", sock_strerror(errno));
 	} else if(r != (ssize_t)info->qlist_len[info->qlist_idx]) {
 		log_err("partial sendto");
 	}
@@ -309,11 +296,7 @@ perfreply(struct perfinfo* info, size_t n, struct timeval* now)
 	r = recv(info->io[n].fd, (void*)sldns_buffer_begin(info->buf),
 		sldns_buffer_capacity(info->buf), 0);
 	if(r == -1) {
-#ifndef USE_WINSOCK
-		log_err("recv: %s", strerror(errno));
-#else
-		log_err("recv: %s", wsa_strerror(WSAGetLastError()));
-#endif
+		log_err("recv: %s", sock_strerror(errno));
 	} else {
 		info->by_rcode[LDNS_RCODE_WIRE(sldns_buffer_begin(
 			info->buf))]++;
diff --git a/testcode/run_vm.sh b/testcode/run_vm.sh
index d14c63742..5f599e144 100644
--- a/testcode/run_vm.sh
+++ b/testcode/run_vm.sh
@@ -26,12 +26,17 @@ cd testdata
 TPKG=../testcode/mini_tdir.sh
 #RUNLIST=`(ls -1d *.tdir|grep -v '^0[016]')`
 RUNLIST=`(ls -1d *.tdir)`
-if test "$#" = "1"; then RUNLIST="$1"; fi
+if test "$#" = "1"; then
+	RUNLIST="$1";
+	if echo "$RUNLIST" | grep '/$' >/dev/null; then
+		RUNLIST=`echo "$RUNLIST" | sed -e 's?/$??'`
+	fi
+fi
 
 # fix up tdir that was edited on keyboard interrupt.
 cleanup() {
 	echo cleanup
-	if test -f "$t.bak"; then mv "$t.bak" "$t"; fi
+	if test -f "$t.bak"; then rm -fr "${t}"; mv "$t.bak" "$t"; fi
 	exit 0
 }
 trap cleanup INT
diff --git a/testcode/streamtcp.c b/testcode/streamtcp.c
index 65ea8d4bc..ffdddbe9d 100644
--- a/testcode/streamtcp.c
+++ b/testcode/streamtcp.c
@@ -200,6 +200,7 @@ write_q(int fd, int udp, SSL* ssl, sldns_buffer* buf, uint16_t id,
 static void
 recv_one(int fd, int udp, SSL* ssl, sldns_buffer* buf)
 {
+	size_t i;
 	char* pktstr;
 	uint16_t len;
 	if(!udp) {
@@ -270,7 +271,13 @@ recv_one(int fd, int udp, SSL* ssl, sldns_buffer* buf)
 		len = (size_t)l;
 	}
 	printf("\nnext received packet\n");
-	log_buf(0, "data", buf);
+	printf("data[%d] ", (int)sldns_buffer_limit(buf));
+	for(i=0; i<sldns_buffer_limit(buf); i++) {
+		const char* hex = "0123456789ABCDEF";
+		printf("%c%c", hex[(sldns_buffer_read_u8_at(buf, i)&0xf0)>>4],
+                        hex[sldns_buffer_read_u8_at(buf, i)&0x0f]);
+	}
+	printf("\n");
 
 	pktstr = sldns_wire2str_pkt(sldns_buffer_begin(buf), len);
 	printf("%s", pktstr);
@@ -381,11 +388,7 @@ send_em(const char* svr, int udp, int usessl, int noanswer, int onarrival,
 		SSL_free(ssl);
 		SSL_CTX_free(ctx);
 	}
-#ifndef USE_WINSOCK
-	close(fd);
-#else
-	closesocket(fd);
-#endif
+	sock_close(fd);
 	sldns_buffer_free(buf);
 	printf("orderly exit\n");
 }
diff --git a/testdata/04-checkconf.tdir/bad.badfwd b/testdata/04-checkconf.tdir/bad.badfwd
index 27d58c5ea..139d31238 100644
--- a/testdata/04-checkconf.tdir/bad.badfwd
+++ b/testdata/04-checkconf.tdir/bad.badfwd
@@ -2,6 +2,7 @@ server:
 	# to make sure the check doesn't fail on username or chrootdir.
 	username: ""	
 	chroot: ""
+	directory: ""
 
 forward-zone:
 	name: "example.com"
diff --git a/testdata/04-checkconf.tdir/bad.include-toplevel.1 b/testdata/04-checkconf.tdir/bad.include-toplevel.1
new file mode 100644
index 000000000..e45efbc25
--- /dev/null
+++ b/testdata/04-checkconf.tdir/bad.include-toplevel.1
@@ -0,0 +1,3 @@
+include-toplevel: include.withoutclauses.*
+server:
+    identity: "top 1"
diff --git a/testdata/04-checkconf.tdir/bad.include-toplevel.2 b/testdata/04-checkconf.tdir/bad.include-toplevel.2
new file mode 100644
index 000000000..fc274fd5d
--- /dev/null
+++ b/testdata/04-checkconf.tdir/bad.include-toplevel.2
@@ -0,0 +1,5 @@
+include-toplevel: include.withclauses.*
+server:
+    identity: "top 1"
+    include: include.withoutclauses.*
+    include-toplevel: include.withoutclauses.*
diff --git a/testdata/04-checkconf.tdir/bad.include-toplevel.3 b/testdata/04-checkconf.tdir/bad.include-toplevel.3
new file mode 100644
index 000000000..3a219a8a2
--- /dev/null
+++ b/testdata/04-checkconf.tdir/bad.include-toplevel.3
@@ -0,0 +1,6 @@
+include-toplevel: include.withclauses.*
+server:
+    identity: "top 1"
+    include: include.withoutclauses.*
+    include-toplevel: include.withclauses.*
+include: include.withoutclauses.*
diff --git a/testdata/04-checkconf.tdir/bad.include-toplevel.4 b/testdata/04-checkconf.tdir/bad.include-toplevel.4
new file mode 100644
index 000000000..8dd4555b6
--- /dev/null
+++ b/testdata/04-checkconf.tdir/bad.include-toplevel.4
@@ -0,0 +1,7 @@
+include-toplevel: include.withclauses.*
+server:
+    identity: "top 1"
+    include: include.withoutclauses.*
+    include-toplevel: include.withclauses.*
+include: include.withclauses.*
+include-toplevel: include.withoutclauses.*
diff --git a/testdata/04-checkconf.tdir/bad.include-toplevel.5 b/testdata/04-checkconf.tdir/bad.include-toplevel.5
new file mode 100644
index 000000000..b2c0eae82
--- /dev/null
+++ b/testdata/04-checkconf.tdir/bad.include-toplevel.5
@@ -0,0 +1,8 @@
+include-toplevel: include.withclauses.*
+server:
+    identity: "top 1"
+    include: include.withoutclauses.*
+    include-toplevel: include.withsomeclauses.*
+include: include.withclauses.*
+include-toplevel: include.withclauses.*
+server: identity: "top 2"
diff --git a/testdata/04-checkconf.tdir/bad.include-toplevel.6 b/testdata/04-checkconf.tdir/bad.include-toplevel.6
new file mode 100644
index 000000000..4f578f5cf
--- /dev/null
+++ b/testdata/04-checkconf.tdir/bad.include-toplevel.6
@@ -0,0 +1,10 @@
+include-toplevel: include.withclauses.*
+include-toplevel: include.withclauses.*
+server:
+    identity: "top 1"
+    include: include.withoutclauses.*
+    include-toplevel: include.withclauses.*
+include: include.withclauses.*
+include-toplevel: include.withclauses.*
+server: identity: "top 2"
+include-toplevel: include.includetop.withoutclauses.*
diff --git a/testdata/04-checkconf.tdir/bad.include-toplevel.7 b/testdata/04-checkconf.tdir/bad.include-toplevel.7
new file mode 100644
index 000000000..386f0166e
--- /dev/null
+++ b/testdata/04-checkconf.tdir/bad.include-toplevel.7
@@ -0,0 +1,11 @@
+include-toplevel: include.withclauses.*
+include-toplevel: include.withclauses.*
+server:
+    identity: "top 1"
+    include: include.withoutclauses.*
+    include-toplevel: include.withclauses.*
+include: include.withclauses.*
+include-toplevel: include.withclauses.*
+server: identity: "top 2"
+include-toplevel: include.includetop.withclauses.*
+include-toplevel: include.include.withoutclauses.*
diff --git a/testdata/04-checkconf.tdir/bad.user b/testdata/04-checkconf.tdir/bad.user
index 40631abb4..ffa556e44 100644
--- a/testdata/04-checkconf.tdir/bad.user
+++ b/testdata/04-checkconf.tdir/bad.user
@@ -1,2 +1,4 @@
 server:
 	username: blabla_noexist_user
+	chroot: ""
+	directory: ""
diff --git a/testdata/04-checkconf.tdir/good.include-toplevel b/testdata/04-checkconf.tdir/good.include-toplevel
new file mode 100644
index 000000000..e88df7d56
--- /dev/null
+++ b/testdata/04-checkconf.tdir/good.include-toplevel
@@ -0,0 +1,16 @@
+include-toplevel: include.withclauses.*
+include-toplevel: include.withclauses.*
+server:
+    identity: "top 1"
+    include: include.withoutclauses.*
+    include-toplevel: include.withclauses.*
+include: include.withclauses.*
+include-toplevel: include.withclauses.*
+server: identity: "top 2"
+include-toplevel: include.includetop.withclauses.*
+include-toplevel: include.include.withclauses.*
+include-toplevel: include.include.withclauses.*
+server:
+	chroot: ""
+	directory: ""
+	username: ""
diff --git a/testdata/04-checkconf.tdir/include.include.withclauses.1 b/testdata/04-checkconf.tdir/include.include.withclauses.1
new file mode 100644
index 000000000..49c88fe8c
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.include.withclauses.1
@@ -0,0 +1 @@
+include: include.withclauses.*
diff --git a/testdata/04-checkconf.tdir/include.include.withclauses.2 b/testdata/04-checkconf.tdir/include.include.withclauses.2
new file mode 100644
index 000000000..49c88fe8c
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.include.withclauses.2
@@ -0,0 +1 @@
+include: include.withclauses.*
diff --git a/testdata/04-checkconf.tdir/include.include.withclauses.3 b/testdata/04-checkconf.tdir/include.include.withclauses.3
new file mode 100644
index 000000000..49c88fe8c
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.include.withclauses.3
@@ -0,0 +1 @@
+include: include.withclauses.*
diff --git a/testdata/04-checkconf.tdir/include.include.withoutclauses.1 b/testdata/04-checkconf.tdir/include.include.withoutclauses.1
new file mode 100644
index 000000000..3552d769c
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.include.withoutclauses.1
@@ -0,0 +1 @@
+include: include.withoutclauses.*
diff --git a/testdata/04-checkconf.tdir/include.include.withoutclauses.2 b/testdata/04-checkconf.tdir/include.include.withoutclauses.2
new file mode 100644
index 000000000..3552d769c
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.include.withoutclauses.2
@@ -0,0 +1 @@
+include: include.withoutclauses.*
diff --git a/testdata/04-checkconf.tdir/include.include.withoutclauses.3 b/testdata/04-checkconf.tdir/include.include.withoutclauses.3
new file mode 100644
index 000000000..3552d769c
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.include.withoutclauses.3
@@ -0,0 +1 @@
+include: include.withoutclauses.*
diff --git a/testdata/04-checkconf.tdir/include.includetop.withclauses.1 b/testdata/04-checkconf.tdir/include.includetop.withclauses.1
new file mode 100644
index 000000000..5e296548f
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.includetop.withclauses.1
@@ -0,0 +1 @@
+include-toplevel: include.withclauses.*
diff --git a/testdata/04-checkconf.tdir/include.includetop.withclauses.2 b/testdata/04-checkconf.tdir/include.includetop.withclauses.2
new file mode 100644
index 000000000..5e296548f
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.includetop.withclauses.2
@@ -0,0 +1 @@
+include-toplevel: include.withclauses.*
diff --git a/testdata/04-checkconf.tdir/include.includetop.withclauses.3 b/testdata/04-checkconf.tdir/include.includetop.withclauses.3
new file mode 100644
index 000000000..5e296548f
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.includetop.withclauses.3
@@ -0,0 +1 @@
+include-toplevel: include.withclauses.*
diff --git a/testdata/04-checkconf.tdir/include.includetop.withoutclauses.1 b/testdata/04-checkconf.tdir/include.includetop.withoutclauses.1
new file mode 100644
index 000000000..a411f7b52
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.includetop.withoutclauses.1
@@ -0,0 +1 @@
+include-toplevel: include.withoutclauses.*
diff --git a/testdata/04-checkconf.tdir/include.includetop.withoutclauses.2 b/testdata/04-checkconf.tdir/include.includetop.withoutclauses.2
new file mode 100644
index 000000000..a411f7b52
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.includetop.withoutclauses.2
@@ -0,0 +1 @@
+include-toplevel: include.withoutclauses.*
diff --git a/testdata/04-checkconf.tdir/include.includetop.withoutclauses.3 b/testdata/04-checkconf.tdir/include.includetop.withoutclauses.3
new file mode 100644
index 000000000..a411f7b52
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.includetop.withoutclauses.3
@@ -0,0 +1 @@
+include-toplevel: include.withoutclauses.*
diff --git a/testdata/04-checkconf.tdir/include.withclauses.1 b/testdata/04-checkconf.tdir/include.withclauses.1
new file mode 100644
index 000000000..d67920e06
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.withclauses.1
@@ -0,0 +1 @@
+server: identity: "withclauses1"
diff --git a/testdata/04-checkconf.tdir/include.withclauses.2 b/testdata/04-checkconf.tdir/include.withclauses.2
new file mode 100644
index 000000000..3537974c0
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.withclauses.2
@@ -0,0 +1 @@
+server: identity: "withclauses2"
diff --git a/testdata/04-checkconf.tdir/include.withclauses.3 b/testdata/04-checkconf.tdir/include.withclauses.3
new file mode 100644
index 000000000..5e19c54ef
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.withclauses.3
@@ -0,0 +1 @@
+server: identity: "withclauses3"
diff --git a/testdata/04-checkconf.tdir/include.withoutclauses.1 b/testdata/04-checkconf.tdir/include.withoutclauses.1
new file mode 100644
index 000000000..3b3b6f48b
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.withoutclauses.1
@@ -0,0 +1 @@
+identity: "withoutclauses1"
diff --git a/testdata/04-checkconf.tdir/include.withoutclauses.2 b/testdata/04-checkconf.tdir/include.withoutclauses.2
new file mode 100644
index 000000000..fec8b2002
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.withoutclauses.2
@@ -0,0 +1 @@
+identity: "withoutclauses2"
diff --git a/testdata/04-checkconf.tdir/include.withoutclauses.3 b/testdata/04-checkconf.tdir/include.withoutclauses.3
new file mode 100644
index 000000000..e34a4b12d
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.withoutclauses.3
@@ -0,0 +1 @@
+identity: "withoutclauses3"
diff --git a/testdata/04-checkconf.tdir/include.withsomeclauses.1 b/testdata/04-checkconf.tdir/include.withsomeclauses.1
new file mode 100644
index 000000000..d719a44f7
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.withsomeclauses.1
@@ -0,0 +1 @@
+server: identity: "withsomeclauses1"
diff --git a/testdata/04-checkconf.tdir/include.withsomeclauses.2 b/testdata/04-checkconf.tdir/include.withsomeclauses.2
new file mode 100644
index 000000000..ec910e1a8
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.withsomeclauses.2
@@ -0,0 +1 @@
+identity: "withsomeclauses2"
diff --git a/testdata/04-checkconf.tdir/include.withsomeclauses.3 b/testdata/04-checkconf.tdir/include.withsomeclauses.3
new file mode 100644
index 000000000..dbb696eeb
--- /dev/null
+++ b/testdata/04-checkconf.tdir/include.withsomeclauses.3
@@ -0,0 +1 @@
+identity: "withsomeclauses3"
diff --git a/testdata/09-unbound-control.tdir/bad_control.key b/testdata/09-unbound-control.tdir/bad_control.key
index d29cdbc91..84d3883ed 100644
--- a/testdata/09-unbound-control.tdir/bad_control.key
+++ b/testdata/09-unbound-control.tdir/bad_control.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDti51Z6qASvAjPFFhLLlq8BwtsnmfqMPMn57dKAghb4OifeL4G
-SLOE02/hKDkdkOvaUG2UqDNh2OoPTuJk4A+mG2LJoziFhHKlIebo9v2YiFWOBVtO
-DWc3tXPT1IlSEN0xnAGelMmeLcPeCPe+A5IDlIHzF/+YiDgS38S9dL17owIDAQAB
-AoGAG3w/DatfMCu/nS5OdQx9BSqPgNbnUSqux9xA0fhgPTlN0T3oRtPcqa7JUDUW
-PryI/a62ry+zGkw98N2AxolCZg3N7Z3vuRx2FMcKKNwpTzDmcZW7TmMk5FPof6gE
-PnYl/ff0w+kxqA+L2EexH3Xi6ApLSZcjyzKWj+dL2AuT9gkCQQD3dPitwITxgCAD
-IaHw23e3FRkM/hw1Gp8bt6nbuxitVxxpO96q1EQ+fCy/mf0bMEJDp3xzMEIfP3r4
-GmNbaxa1AkEA9b8LeBLbQ2cm2+UMeUgygBsRirdUQ786auqH38Jbvi/j6S9sDl2x
-q1vRtikEBZJWfkhsOzrzwFDKe1bI/EEn9wJAAzOwRA9JqRZPU7sLrWIpmmTbfh+L
-neRKSsGFoSI6n4ORCouLxgoZF/XjXldPvxpQwS9ZnOPy9xSLMsqknno0QQJAeDtA
-IT8Yh6GwIWWu9KeeDY8wxe1sDLlCm4yjbZZpzGMh3rSU6XJtuqjxsW3fydoO9zn3
-ugLdvvnIFxAexUwbgQJBANyM13xcObfUJOj9rjlGCh0CDh/04ONl8SH8HBnM8guA
-RJI5S6vBHweVRopEZcF1sQm6wMf3ej/sGkyyNvJxRkY=
+MIIG5AIBAAKCAYEAt/3PPZGM7eSdCnEQ04f6Y+Xnmp105gtxqoHxHfyGFG8ljNSd
+T1hKBjrg1BRVszTg+Td5V+Y4vAHW25Etvuvg0DQBNDKtrMTTbTZKQbT6A7Xgyp42
+Oj8EyXFWs8BNx/joI1sAMUiCjPKpKAI5bIHV18It4n28MXWTVX5mfwcj82XPTQlO
+6OhTXtA45idPLFKkCp4H879EIfIo1sfk+OTLjoSNLXFN3BoI9CIT6WZKrY0pAieL
+jdotSlirx/UpwpojAp6IVxzjZ2PHnJZbBwHxVPYnysMogcKQ9CyL1jBT2phWVe2J
+YJFwwGgziJH5CJEGVgWkctEtguKubzSCIf9RuX6j/n32ZRtAechm2Oi2WwxGr9tF
+uzLXgYsu/MQ+AhzcFP1MEGlyCkyL2fxgDry34Rq7RVQQL9PolhBYk2orYTlsjCVR
+kGzXvpFIF8OPDEEsXz2TTM2nkiCla1GqsGXL3xuPFjGD+CEMI5jB7U+j1uL2+xb/
+gVUMAxvpNHADcW1/AgMBAAECggGAFEXF8N25rniTCRR+KyB/aURqqXGR8MrwAj6B
+B7HMQDIi7Ap9LsHmnhscrKF08+Luqub+2r2GIMj/GIA9jxzET4x7WXoAAtpJBW6G
+7gh3x7LhitG13eMVrvBrAjE9ILx/L24Wblez8r3F/5+HHjqMClLd5We/NZ/j1Pax
+amup/WaJWc6dwDHhBcBhlJJeOd79LiJNdADuC+N3tnqd8wKanyBhwdELKCZCOEwM
+75mSvt6f1xnuWXnhpaBxhP2xVTzQUNz1jxA2j/ybDbnBdhjLn9QlBY604t8nwRz8
+dwCV6NRFbj85C1Fkw3FSzLSKzkzLGxYBvLpq6vjXiUHuY17bVDskCrgHOx/q0SXb
+ivPdmJWhThfPUMRgSTQXXvWpQfEdBP9FDXLFPN6yI9Xocxa4oaalNaK+xIJyXt9w
+ZkLb+ZB8+m4JqvgdrQiO0yEXM498aCdRfVnZV/e+GdbB90FW9SFf4/guca/I4SPD
+sFpA96LOyxkX4h5AQxyeoDDriKopAoHBAOEQXDMIXxp9gmkZNRo/mW7RvnmUyDic
+eCwCbcsLGjay/hKpyOTelXSF7bxdi6GuO5N9UWBQX2FK+//T/uT1kHjmUYTeLa47
+iSDJG73TT6ZSwI0D8Ak+4GEneS3xjldpPW1oFZt/kwuji6yfUFw6orsPa/l5Uf7/
+MCOzoFObtvDZKgd0BkBrQhlIG+u6jicrGfrVkCDX/ONqoQXr3a21b4nl52/r+ezj
+N2kKSQOTll5pUQ00+M0SPDwytFJbhbkTpQKBwQDRSCzHPTGVW5R+8BPQY2mRRyjp
+Pr1BmJXG05f2wjXeGhafWJ91RCwP7mOBbJDA15w3KoY9N64Rk6Mv5q0Ywwna7+Ea
+pTXCfzeuoC+sLL6llCA4kbpJsvrLAeCYyvMuiPjgXfDo2S8qMqAnZ+ZKD16OjBzE
+W6H2OI7Zmwjy7+C683Ac2kX+lIvbBeOu9oVtaSw/5nudScUi4njDz89Ha3g3j1AI
+98crCLQdjTO94d5k4Mx4FFVdbxPwSa5iZcHWo1MCgcAnHI25PKIyW09Xbk8BIb5L
+ON3uCQIGfIKRu1ZTK7nBebeXjLPhuiCk4EVhL6x9S2cFCYkjwLPil4JVggTQyy/x
+Iq1V9rpfhe8dqHVOtrMnx0e4+c8z/B5II/D2H/1JiXtoUOc4X6IxKpmyRPlVHcd7
+1IFCGGg8dSJrgeLBxNS05DhelTYk6b7R3+siOwhLHD1mjsh+PKqw5q3W9pdOgbJB
+d5eRpqOHHDFb6rKnkXVXMNwp/GOkV5/qIjGeAlOpxxUCgcEAlXLFB0Jbthy/3iXz
+AEz9hhEa1fVHkSA1VNalHkFx1jkrDn9q34LfNEE4LaQpeox9sadcVTr9wu97CSnh
+Ul11HDNQvIZd7ZaLXNhnMryBKByvJbZrIVX+YhnlGTdUkVae4xoyfxUY6TldxMYd
+XaW8EG9d25rT/dBFsn9T1KgYA2j0FqaIdVP+y1lZTggdIBSK1NbyT0/uxwqS0sID
+cyz7nDFrJfxK7iA4/yFmYaJ5/e/KE7Xxf9dilaUIMpwX3/6hAoHBAIYjfpbPfK21
+AwHgZiopxOODsjbMuO/f4VCaMhkt8bm7LRmbsNl/Sk9paTNKf20fttKLi2cSUIn8
+sP8iuwdrUNNhVd4cfsh+ncF4GitRs3WrZXEz8AB7m8frpzNr2pYcqVTPL8yl9i8t
+ix0XEoVwMWgFroWaN/G+ujEoPZUgXI9z5DuArkNOiLgbpcqVJ8e/+SWTeKILIkWT
+ZrFABevmFIaXSZLjI9Avk7cTqEKOVeZy9gag9lmbtVAzFFitdR4aWA==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/09-unbound-control.tdir/bad_control.pem b/testdata/09-unbound-control.tdir/bad_control.pem
index e06b84720..0785acaeb 100644
--- a/testdata/09-unbound-control.tdir/bad_control.pem
+++ b/testdata/09-unbound-control.tdir/bad_control.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBozCCAQwCCQDd5/rocjG5vDANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkyNjEyMjQ0NFoXDTI4MDYxMzEyMjQ0NFowGjEYMBYGA1UE
-AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDt
-i51Z6qASvAjPFFhLLlq8BwtsnmfqMPMn57dKAghb4OifeL4GSLOE02/hKDkdkOva
-UG2UqDNh2OoPTuJk4A+mG2LJoziFhHKlIebo9v2YiFWOBVtODWc3tXPT1IlSEN0x
-nAGelMmeLcPeCPe+A5IDlIHzF/+YiDgS38S9dL17owIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBAHpvcKqY48X9WsqogV16L+zT7iXhZ4tySA9EBk1a+0gud/iDPKSBi7mK
-4rzphVfb4S207dVmTG+1WNpa6l3pTGML6XLElxqIu/kr7w4cF0rKvZxWPsBRqYjH
-5HrK8CrQ0+YvUHXiu7IaACLGvKXY4Tqa3HQyvEtzLWJ4HhOrGx8F
+MIIDszCCAhsCFEm6EpzKglG+V66IyIlx6Q2y3y8nMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMzA3WhcNNDAwMzI1MTMzMzA3
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQC3/c89kYzt5J0KcRDTh/pj5eeanXTmC3GqgfEd/IYUbyWM
+1J1PWEoGOuDUFFWzNOD5N3lX5ji8AdbbkS2+6+DQNAE0Mq2sxNNtNkpBtPoDteDK
+njY6PwTJcVazwE3H+OgjWwAxSIKM8qkoAjlsgdXXwi3ifbwxdZNVfmZ/ByPzZc9N
+CU7o6FNe0DjmJ08sUqQKngfzv0Qh8ijWx+T45MuOhI0tcU3cGgj0IhPpZkqtjSkC
+J4uN2i1KWKvH9SnCmiMCnohXHONnY8ecllsHAfFU9ifKwyiBwpD0LIvWMFPamFZV
+7YlgkXDAaDOIkfkIkQZWBaRy0S2C4q5vNIIh/1G5fqP+ffZlG0B5yGbY6LZbDEav
+20W7MteBiy78xD4CHNwU/UwQaXIKTIvZ/GAOvLfhGrtFVBAv0+iWEFiTaithOWyM
+JVGQbNe+kUgXw48MQSxfPZNMzaeSIKVrUaqwZcvfG48WMYP4IQwjmMHtT6PW4vb7
+Fv+BVQwDG+k0cANxbX8CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEATI+xHWEiq3SK
+9Dw2FBiD7GPaaPAh/u5h+QxaLS9G5a6Djh6F9RT3To+gRVeiaAaIPg53asGM5TGR
+ojv9nI8cIvi3dL6VKhHSdomldFjfQYmF/uSKEYsHaggceGE/GsG8J8g79HXGRp2y
+m5hkACKFh5ZcSHeJBplv7agDbBZ6w5qQaY6QsnYLrAK7B3Jo1Xx+JEKzmgnp4TwV
+Ni4wezgLiG+buJ5lXEYr2Rm7HR/cxLRN7CFrpUoavFUvqLKNpXO8MJFx+BkO5/JT
+pgv0O/ll9aT+kuegUpf9kcUzhpsw1N4W/JzZOyJAdxrrQ88aNZm+7d433wDBt/WF
+BCV4d5wEASxfQALEQa+/1FebIsDfQyBAOHdTAVkupZ00oeNerKe+mHFmNjj04vn8
+LwGgVuADCBJVCDhEqHLEXUqiGeSHJhAJO9pjma7r7H81OtAs/xVC8j8hqe8wLBKg
+XNjWQ9QmNXt9VVQCMomro9lmoDozr9k1vsGtUsT3yQEAABQYwIjp
 -----END CERTIFICATE-----
diff --git a/testdata/09-unbound-control.tdir/bad_server.key b/testdata/09-unbound-control.tdir/bad_server.key
index 0dbb134b5..d64d05bf5 100644
--- a/testdata/09-unbound-control.tdir/bad_server.key
+++ b/testdata/09-unbound-control.tdir/bad_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC9hurNHBtB7QFEuPJOnCylUWUF2/US3v9yQQQXnstuXMQXRaq1
-1uviLmwaGurV9tngX59HITsBT74NQrtFKfEDLViLrm2arAM9Ozsn4tnv30HXPRDj
-UOc1M05Q7UzjaSrOv+TkPEqyhtUyaP1DYo0bcmbxtSkYc2ZEWCwhPklUwQIDAQAB
-AoGATjzZxN4ramWaNnJapJTX4U7eczK/0pB3xwSL2exVcjOdRzYdKH+WVIJxYb1m
-3/jNLFCNAeH356yxeevoPr73nG75YJ9I1ZWQWTnS3SDK6JD1+3pmAD0bQWFoitpf
-FoSH9H4X5gFB5vCZ99YVoYH1UXWPcgvUHwxz0voImt6lCKECQQD4YQ4A3M0+Ki8v
-Hl+5FKULnS0UtBkweCvkF/X1zZRjjYr6hLnqldFkkgTBKWe17pUXX0nwRMbP1YZX
-i+vDq5JNAkEAw1eYsmC0nVAMawo57N6LYavGv/n5u1cvpTpKDtn4cXH0Uqq13Kyu
-2FUTzan2NhCEK78UzbWaeewBJmxYda1+RQJAdShKk6uTAEyjnwUjv8h2JWlJN2fQ
-LeWxRlDrCruiz+aW9J4gl/99GoQpy/c83TshhjnDRZsbcDNWv/rXBZ/rTQJAFQva
-CtX6f7yBKgM3DHtJvyM3zbVMH9Ab9QxbsE/xwZ9KeKGl6Hm+eNZpxM3cFiUfaGs0
-/ZjkZOB1m0MvILaplQJAXC3PJ/E+87banGZRJl5qtS6/HoX5lH9TPkL8Essy7ANO
-2BT2OTQawD1A+VKIrQHXs085Of8tQUfrfHHt7s3Kqg==
+MIIG4wIBAAKCAYEAr7FId+AlZUWP6MK9xfV0hJ9ooJdcL0sm9yZsWY4UYOlqcTGE
+Rah/XvQmsOaKcMg8Wof24LAvo2vmariBYZoS61AAi6MeHHrPh8M2ZDMZQgW4nZC8
+A0biro93nMLU1VxgycSVmj29p18IdNzsYWxC7t+/6AWQSlwD+9YFOYrVWQYxEcSZ
+7gZqoh08mDsNRjnVs7nagPAbk/B9jj9zhvgp+0d5h25Ms7Td22t7DfsGlL8Ei3ew
+FwaqjThhhVHEVwARBLYGb2ZsZS5EMJv2W/V0k6yQZ+rV07+i0oZQ0cGxOuUy9TNO
+7HfiI4ri2x26Wm0YH1qgK5miUIAkbL2E/iWVxMfQOdEAZuOmUpUFOFpm/XHL1/pC
+yiqOb98jjLE93UoNPZdsjrbjfQ/WPkap+vtigVZJJPet6F9x4S5XvrhXkV2JWIYM
+vhnrs9NpveCOe1lcxNVSsIAtMxsZKi2dIq+mRhfm9/UGoOmj8UxIQUepJJv1IHcd
+ASWkTAMmUSyF7z7DAgMBAAECggGAKwY+GeURI1C6oiR2drDaPNQQuir2zzoXK7UE
+GZY6lVTz1Q5sNubBck5V30JFqsLOTNk48uMSd3Gn9oCCZpVlhqyLxaZHbHACvFto
+yXbd+5YNFMDp2d+VCWxmvUPU/P7nUOHMRP5ToFYcawni9SSe64Jtq3MZV6xa6WQK
+2YGPJ4Llp1U+4NQ/br28JgdoA8eL9rxPrv2ds0fUZ25Qa0AAf+GL+Edhjyx+nAoh
+E1Zi0TBJ+6FuxOTEBVtGPnC8pRWFrYDfiMX4y8qkbbanAQCNgLn0PC0JdKpFAtk/
+hnpGsZ4/oh0D3ogi6o5Xnn9Gl5+1uqqaEs/n6A4kojcJ/Z0uO7zJultSUDeggbA9
+VoTQucFY1Cqj68d56Rf3kS5FGgAOx7Q6LVCIH7C9+bfs7N6z/2zl6sF72ey88kpK
+ZxsPjGUw2OHnwdrkfZHVMjiNUgrEH+KYe8EVmoBxoafGvxcs9mppqeczP3zbf5WX
+8LBLQcIqNaSWAsuKQbJTNsbKEIT5AoHBANcs1QPluTGTY3BXvGMwjl3dDyf1h10u
+iaGi1tDB60YtF++RnwOl40Zi1Gu8GqmmzY9j32EG5moRO6IhuZ2U+lZcK/AiwY00
++4hnzc0hBInFlq3lLRa6zVj4rEeQJxuKXykJGLQyKtSqtppcAo7hWE08ZZ6DlnvP
+4o4R9ii6gCZcajhr5Bh9FxZOHv+5gMRzOVWmMF0JSjnVToCi0UUY6b3roRdH/U+M
+3EOVCOUT1WE7cGuZffkcQ3jQEsC9zRHFFwKBwQDRBsKIfm0FMjP2Z0aQDpHO5wR6
+Vcjw2kmVukTPqlYPcDGaYbUVuQJIR7+ffd8xk0YbIeOfO/bXGngLAjKSGz20JIIW
+E/B5RkVycwjD/WeD5NMvKc3NaiT3aiXmnwz1YUzxDHByAtskAKsoXE/GIsyVCbV2
+vDaBn3MCywTvcC9RR4KYeTepKMvd4N8KLgP9n/+hKd1ElsBVnPJUyYabmaOC1tpx
+DUyWu3dbhKBKcfEcyt1+YT1bPrfRnG9oxyRStzUCgcA8R9sFVH4lXV0mQ+4K+7dm
+pF9yml5pxHfaSHxVz33SEx/5hZo+s2KQfW91HyV5EbnUye3yiLRUUq+aJEiT1QCs
+4PWOOK5wmL8+35XQOcfDsQ8deG7BR2Pv4PqiscfC92jhXiMFmGhXW9v8Mnqk/Ix4
+VstBNSwbU4nssyt7DYSJOqqnU9J66dBl90zH53gjkQQm8n/qEIgy24c6kmJ+MRSK
+mFBw7UIR3yx14nKzenL04moEOuQHvdtJJUGbrZCdwdECgcBCra9cr0fDwpIE5kkC
+J0OoBtXM2JSzEE8s7jCJNkMhxZ5tKwIDHfN2bzzXeeW7AMn6WcMsxoolcBIfIOJU
+7U+vqX294Tpy1VHOApgnPSzKTDJ59xHplxSXwEq62L3fgNx0gI1WMUcKoxP2Wgww
+nmU4ndI/QCb7Dow3td+rKdROT0t/rBtvYM43x0YfDzLCs0luddZZzOUp6lj7ZxYD
+iO06DaO9MIrgAok+rn4bgWFy19v0NrzF4KnuucJoYC5cHIkCgcEAzG+0oppa1L+e
+Tw+511VtO070XJ0Kx4DNKjP2F5nFSqTkDAyEEiLoIArO5dYGG5nHy3lXSoj+wvOe
+1+3KTZPeFA7ZByceehFXrULT4GbHwbsimzLWBXAF2Dgzb2OZYMnKuFR/tjlW0+vP
+OP86cEkQXNJm4SsxxeFjJAcxxif305OzgL8oqndOsohopB+XCbKUP231HBMGJ4MR
+EljQHXm63wWWiBUmrX0ZYzWkX5KiAbDlfhvde80fKsDOUrzZfoBw
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/09-unbound-control.tdir/bad_server.pem b/testdata/09-unbound-control.tdir/bad_server.pem
index 983247ac7..b81fb19f2 100644
--- a/testdata/09-unbound-control.tdir/bad_server.pem
+++ b/testdata/09-unbound-control.tdir/bad_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQCDugnhq8B6LzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkyNjEyMjQ0M1oXDTI4MDYxMzEyMjQ0M1owEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvYbqzRwbQe0B
-RLjyTpwspVFlBdv1Et7/ckEEF57LblzEF0Wqtdbr4i5sGhrq1fbZ4F+fRyE7AU++
-DUK7RSnxAy1Yi65tmqwDPTs7J+LZ799B1z0Q41DnNTNOUO1M42kqzr/k5DxKsobV
-Mmj9Q2KNG3Jm8bUpGHNmRFgsIT5JVMECAwEAATANBgkqhkiG9w0BAQUFAAOBgQCy
-zGMW35/9xXoEWsuLFWUOaEKVq5DXuXtXbcMpDW6k2ELoraa305vh7Zwhj5JSqfcm
-O0xyqIzXvz/cYdyOTgEkdMDZ/EvQsxKTwvj6eA4614yB1r3Ju5eZd4Gpo6BHhSpu
-oqsrr0duJ+JOANTyaBplIxM1sjHbR4FGtmrFknBYBQ==
+MIIDqzCCAhMCFFzmVNbhjiApmjK3VeO/j9TBp8yOMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMzA3WhcNNDAwMzI1MTMzMzA3
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAr7FId+AlZUWP6MK9xfV0hJ9ooJdcL0sm9yZsWY4UYOlqcTGERah/XvQm
+sOaKcMg8Wof24LAvo2vmariBYZoS61AAi6MeHHrPh8M2ZDMZQgW4nZC8A0biro93
+nMLU1VxgycSVmj29p18IdNzsYWxC7t+/6AWQSlwD+9YFOYrVWQYxEcSZ7gZqoh08
+mDsNRjnVs7nagPAbk/B9jj9zhvgp+0d5h25Ms7Td22t7DfsGlL8Ei3ewFwaqjThh
+hVHEVwARBLYGb2ZsZS5EMJv2W/V0k6yQZ+rV07+i0oZQ0cGxOuUy9TNO7HfiI4ri
+2x26Wm0YH1qgK5miUIAkbL2E/iWVxMfQOdEAZuOmUpUFOFpm/XHL1/pCyiqOb98j
+jLE93UoNPZdsjrbjfQ/WPkap+vtigVZJJPet6F9x4S5XvrhXkV2JWIYMvhnrs9Np
+veCOe1lcxNVSsIAtMxsZKi2dIq+mRhfm9/UGoOmj8UxIQUepJJv1IHcdASWkTAMm
+USyF7z7DAgMBAAEwDQYJKoZIhvcNAQELBQADggGBAG+IhOsdEiaVCOB8PBRGJQ8F
+/kyeQOtE7pPPkH57qYwAW9cxdSoiIxrvase30IGLWmOzjiAc/igf1qz/bVpwFXQr
+XohzyeQJ2znlGzUbo67c8rocvWxHzvZwFuQEysJp/E9ft5kiWwoU/xVpoK5p9sxW
+zRTTdpA24x6rqvk1ZFzwWGSg0yhjOYfwvwg3kGCbwe3GzAk1J65E+uJPFoLySbNL
+p3eUDA2rUKDjVobJOEhtV8k/l+hB0kKwiz/A2sbMT/OoByWMNFKSkmDbNi5m5gJH
+FHsZsucbL6ppLy7fmOiPlx6xejbiTR3uAn0aQImdHA5kyfAXLKhTkyYdjWHiHqdQ
+XMxi0Ci7/HO9mRupbcjRZEPs//ozMxjOAg4VNasDLdnDI4EKrClqYPjsfoXXXiZf
+YTPH9QypxJFGmGEH865BNacEjDBeag8ck1ZTiK/GlrAJMqfV5/60GWBGRQVV/Tvd
+WXWY2x0gVp2fxtxF8JCvHKAcfUg2+LrUS7fbMx2Niw==
 -----END CERTIFICATE-----
diff --git a/testdata/09-unbound-control.tdir/unbound_control.key b/testdata/09-unbound-control.tdir/unbound_control.key
index d7c43a06b..753a4ef61 100644
--- a/testdata/09-unbound-control.tdir/unbound_control.key
+++ b/testdata/09-unbound-control.tdir/unbound_control.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
-rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
-ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
-AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
-WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
-DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
-4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
-Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
-p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
-P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
-aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
-YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
-DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/09-unbound-control.tdir/unbound_control.pem b/testdata/09-unbound-control.tdir/unbound_control.pem
index 8f1ba87f1..a1edf7017 100644
--- a/testdata/09-unbound-control.tdir/unbound_control.pem
+++ b/testdata/09-unbound-control.tdir/unbound_control.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
-AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
-6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
-qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
-J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
-9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
-iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
 -----END CERTIFICATE-----
diff --git a/testdata/09-unbound-control.tdir/unbound_server.key b/testdata/09-unbound-control.tdir/unbound_server.key
index 4256c421d..370a7bbb2 100644
--- a/testdata/09-unbound-control.tdir/unbound_server.key
+++ b/testdata/09-unbound-control.tdir/unbound_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/09-unbound-control.tdir/unbound_server.pem b/testdata/09-unbound-control.tdir/unbound_server.pem
index aeda3ff11..986807310 100644
--- a/testdata/09-unbound-control.tdir/unbound_server.pem
+++ b/testdata/09-unbound-control.tdir/unbound_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
-y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
-/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
-g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
-9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
-l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
-Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/10-unbound-anchor.tdir/keys/test_cert.pem b/testdata/10-unbound-anchor.tdir/keys/test_cert.pem
index 6e588a4ab..1db9680cb 100644
--- a/testdata/10-unbound-anchor.tdir/keys/test_cert.pem
+++ b/testdata/10-unbound-anchor.tdir/keys/test_cert.pem
@@ -1,15 +1,15 @@
 -----BEGIN CERTIFICATE-----
-MIICWTCCAYKgAwIBAgIJAN5YIkuCvJf5MA0GCSqGSIb3DQEBBQUAMCYxDjAMBgNV
-BAMTBXBldGFsMRQwEgYJKoZIhvcNAQkBFgVwZXRhbDAeFw0xMzAxMTcxMTUyNDVa
-Fw0zMjEwMDQxMTUyNDVaMCYxDjAMBgNVBAMTBXBldGFsMRQwEgYJKoZIhvcNAQkB
-FgVwZXRhbDCB3zANBgkqhkiG9w0BAQEFAAOBzQAwgckCgcEAuPBoYZiFOuk2SnN0
-IsheC+W7JvAJcv8tksyz/hgAnqStDnDrQ4trF607aCQ7xjj2fSAqpiMvLv0P3Ctu
-rcTRHmRXApS3GBf1PjWqoxMK8JBxCIHN4PKpyq4czOtSPH6AFlU+3KsRRwymLgpT
-SE15NYv/2M6Z3/cL1SkOdVvVDrZv1gO4OCAxwrgI6HMsjQtwe16mGsBQzrHTCOGV
-u4QtISEUDrwZL272PFsZrEpHXd9LtSpqCEoOMujr54pKxBEJAgMBAAGjDzANMAsG
-A1UdDwQEAwIChDANBgkqhkiG9w0BAQUFAAOBwQCaA3ys5hDPMNV1oXIxH6u2KfAX
-C9tYJId/SR0x8whsZuNaSEZAgImdM5dnyWdjey8Pio772E9/F2aUBGFkdadZx4My
-d7hBfEi/NECEKs86k9g0ijbin41NKtnajb6GwyNQ9vDx7Z5FS8BZ3CD0BZIdCQUE
-gKuDSWBROQU3tqrjdk2QTwGQkj2mgzT871Jn1MwZw0mczPjS1y469Ejym8wi3uCd
-EboDOoGBCpmUQbxBv6JI75cUCdmNNEwjQjZ0XQw=
+MIICZDCCAY2gAwIBAgIURC8vM7SbxPTMmosTyBzLlqxgsUAwDQYJKoZIhvcNAQEF
+BQAwJjEOMAwGA1UEAwwFcGV0YWwxFDASBgkqhkiG9w0BCQEWBXBldGFsMB4XDTIw
+MDcwODE0MDk0MloXDTQwMDMyNTE0MDk0MlowJjEOMAwGA1UEAwwFcGV0YWwxFDAS
+BgkqhkiG9w0BCQEWBXBldGFsMIHfMA0GCSqGSIb3DQEBAQUAA4HNADCByQKBwQC4
+8GhhmIU66TZKc3QiyF4L5bsm8Aly/y2SzLP+GACepK0OcOtDi2sXrTtoJDvGOPZ9
+ICqmIy8u/Q/cK26txNEeZFcClLcYF/U+NaqjEwrwkHEIgc3g8qnKrhzM61I8foAW
+VT7cqxFHDKYuClNITXk1i//Yzpnf9wvVKQ51W9UOtm/WA7g4IDHCuAjocyyNC3B7
+XqYawFDOsdMI4ZW7hC0hIRQOvBkvbvY8WxmsSkdd30u1KmoISg4y6OvnikrEEQkC
+AwEAAaMPMA0wCwYDVR0PBAQDAgKEMA0GCSqGSIb3DQEBBQUAA4HBAHX0rIirg2Rt
++rp7BnR3riq81b0cWm4Y/UUdGmLtbPTJLuZogfLZhb9hf+185ub/8ZbuwuUFaiUY
+zEcAjaOlPjBeRbNku1xnAVhlgtCIsCOyI37Ey+65OuJxL+0Rpwsyfh0WuR8SdBE5
+OdJ2DuH2yRkTd2JEsNi+DZVIEeaKwXtLGUvsqYWu0GrnXORwGsezfiLM4uAJW+tp
+VA95CKpfS98l1MJIHtlcpffAjfRVZAJnGcXv+P/DtefC8aNukoiqvA==
 -----END CERTIFICATE-----
diff --git a/testdata/10-unbound-anchor.tdir/keys/unbound-control-setup b/testdata/10-unbound-anchor.tdir/keys/unbound-control-setup
index 3e5931199..2492f47b4 100755
--- a/testdata/10-unbound-anchor.tdir/keys/unbound-control-setup
+++ b/testdata/10-unbound-anchor.tdir/keys/unbound-control-setup
@@ -46,7 +46,7 @@ CLIENTNAME=unbound-anchor
 DAYS=7200
 
 # size of keys in bits
-BITS=1536
+BITS=3072
 
 # hash algorithm
 HASH=sha1
diff --git a/testdata/10-unbound-anchor.tdir/keys/unbound_control.key b/testdata/10-unbound-anchor.tdir/keys/unbound_control.key
index 47d15dd37..68b514f83 100644
--- a/testdata/10-unbound-anchor.tdir/keys/unbound_control.key
+++ b/testdata/10-unbound-anchor.tdir/keys/unbound_control.key
@@ -1,21 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIDfAIBAAKBwQC2p0MTVVEfvOpaWlI6rLKGxaHfw/4JUxXCwDHRkkyB0hkISRMx
-8imB+io0aY2Uck9zl0BTgPaKtFeA0+lukZk75keOuATPFZwbCGs+6Tx5AoN4+NzI
-aVay5AuO8E1u6AVdmcAqByP+R92yz5f3T93/cSsYzqPZ6Y1wO9sabtrkGTYwnfMg
-nSttyvlBIhRDWbEO+rWL2CCi0JtrnpiK8sa2ysQCq9Y6ZiGjT9PEWIZwkxQ6y5TI
-WVtyitoknpDheZcCAwEAAQKBwAgeXSPh2e5ANmZ3t0n2XSUSacSJcKQ3djMm2dAH
-4bCvhv9QSDMjIWcumGul+W4Muq1XnrtXcx3tMCqAwNJyVE5OSQX19fjCbCLjd+je
-8xop23AoF6As1nazHjRnR/nTBD7QNx2xbaW8RNbaGpTe2G2lpdbg9myRpyqiB8Pk
-73x/AQcPqm4SHBJS+kU/Q9k9yZRHGQ/PhYlvAmY0SCndew28Pcs+IdCI32k7e/aP
-SCEQvVqKeIiSJ0Zj8RSk8Pz1cQJhANtNsvcEa2V8NxI9yL2zwvBXwoBuU+d9Pszt
-Ooqc/kmvU0FV06HgiIPtTSoHLI7Zh9h5Xn4DFGmtS8WeGhwSVCN1iwcW9F2ldgAw
-LXcoXjEK21KXYFNAYeo07vul/Ly/yQJhANU3lM8hAqq7FB4R5zgUCcp08FOVA8tl
-kEK1JoAdfp6Wv4M2xGJ6tmKcf92r0F8zBDV6oZX/dtPwFzWhBZUi+zaA8PcEqbwt
-CJtmM5ycoX6kkkIfXtAVNZiTIYHn01beXwJgQBFA+V03KtzREeku3gzIJILe9bpF
-lNlIIYIkmh4nQ8uOnQW/4AjCmRgYdPDHmav/PcSnUFUB/6V6/26i3hSUtA9A4H9a
-QIl4IbHxdmA6tEUhsc07fNbQRCXWs3nYjiPRAmEAjDe4MhsYYOUUzs2hTFzJL46F
-ucHGtA0/uM7e2eQLsAmdOpJaxhTDOsiGwmXKa8DmJLFX8IgHQkujR850GGbf5DEZ
-xqkXYrwO6/tjN7w97EYYNUniFV/NVmBz6bVmY7trAmAvvg7MoBlb/o6nwoCQqnUM
-QyjIy9A0t8+KHNMFSQwUldG+HIwiU4/7y2zCqBYJg8NOjrdj/3+73A24rP8wRp15
-zqQCS7mLLWmYx7pWE1ZHN8eY3xGoHmr7LzlB+dzYG+w=
+MIIG4gIBAAKCAYEAzDESJ2lpIno7KpSrYBeBshT8H5dbtNF9rVBONsCmwSSqclLR
+ixZ62OKrUKMVCEpZ0zj4yZOu3DGTfL9V9pEk3dCD8mFmylidYeLh5GHGMcDVWOzD
+VPsnQ9y43KWYeURpGy4QSCxYDb5rrPysleSZwuN5D4lbs/AKdpubAHj6z37Zbrs2
+GjofHp6TaD6ck7jyRXDtqShrnsVXq9U1CadYDOPiE4aZ1TvusRzhhjmDm8GQXalr
+tIBJ5j5EcmRamFhONGLshfj5ECZrKo9L17kOd8PyRMaXNfvl2tpx1qtMxmp7FDpb
+oGGIzP7F7hyaWMI/zAzkTMAtjGkAJWqHgTbSfvlVul23RLvovM3fD/ZiugBuTWY/
+CRpmN7CQFFV6iFyLGjRp8vV7BojUIQX7is8QTxSqW12SsElMXOuUmcCnuIaoGF4n
+AoG6vNLFECtSdLTjQ0uXawIp7dOww4zS8j1/dZzXsVF4G4V7GjeWD8eX7n+HNWoc
+3ojjuYzbWfWvLIQbAgMBAAECggGANUTD8KYuOEFc+BHK14mqWxPgZjltQjG4sKMX
+lG8T0aVIFgUHB1r492XCvYmd7gi/gDwHo0a0wlromA2uVmGtFXTVR0EjuLv/as7u
+kU70jnw47DbwClZu+uQ1EdLdgR1Ysi+FLd7rpcI8gudz+rKlblM7fNMfqkR/5ktX
+13q4K7Ny89FBHvx0q99Ao1xaKquAAJ+iUJPr54KiCYDYkkkmzk4Q53kg3qEA9xGK
+wCJ29AY+LEELiQ5CuR8baiBGBiJa5QegeThbQox0jBlezNWAMOg1seCchpbZ4tHm
+zuM+IRjZ9GRgkxNctQu8nx3Z6QcClpNFW2WfdThI4nzjqvE9C2nQBR+i/a+v0D90
+bX3LbCcPBE5Hr6sdI+pSQ0C3eFOuGZaCdfRxVs6ymWti3STdlMtTgaEOsCswmU0e
+DasWVYbezyPHImb34r0/q1ux4BZkxon1AqjLLYOCF5LQ91v868jdwOIITGL3gviN
+/TYW0ObbJ3Szav860B9vlGUtG86JAoHBAPNcY2LLCVMWkzrsmkyLL8+MmF1dChsF
+/rVt8QIiiStZkV2q3f3F522kVVvH3dYwh6MyzBNPFBAAXHmaY2IjczL3gKWEz0OA
+YlKv5+KoEBlRtonJIHSs6GCjdnl6EJ9NyF8NHq/tgpab326Dpb7RyXzMv2EZV5uY
+kp3WVqJZONa1xEHYud9SOA7TA3X/7td7bC49b07n0SidH2N93ZZMd+oApjsHx97q
+9J1BxCbaJdPX7mK15pPPWD7vPZqsxyeSjQKBwQDWy+hH1jrr26UUAdIq6SgQxPXh
+Y2+epVbHGD0UK51Io0rAg0m3Nlaxr28EPc/MLfjwzwPs6cHdM1j1FMqwGCYiO8mw
+CV+XqPVDc6Xqzklf+awMqhn71j+M4Y4Dr6K71fXQ9ek5X+9I47I6iuVLOOegLm29
+qSlg/x1fOkQUKnJNQw6aEJmPj7mi6q693E+oa6hzVO160AGe4tAJoidaR7ifwKU1
+ySOhXtugs2I2P7lc07UtkIwftiYS69d1CRE2G0cCgcA41hj4F8dDuoAEQQIAYnl2
+FbX4CCS2Dv5fzR9+iiZTE4YZxDA4dqIIP1sYJmOvBIKJIPH8iHl9CziNxfr0Dqd2
+/crz3UKy1ycffKnBi9LGtwjUwT5tQXy8JTEkSdfb/MSRPnUuTWA0YI8cNm7dVA2k
+sgT4XnzRgB6t8kMlg4T80FLXthAjEga5n5qtUmqrtM2dNwfp+8YjoB6Wk+zOj2lq
+I2CvZK/PZjxfBd8T29r90O6B603As6o+eI2AtF2G5nkCgcAuhHBkhleyVpoUkCRk
+2KOtpgod6rv0npgBfBVWNe/VGFALCyO+wszZpEWlpIFJFbew5xRRjXpHnmQoh30x
+z7kKdupB7nW+UX/0QKpxBIXNfDOvdnM0H/0ZVIu97p6OkVKwE2GT5Fvc7DrgBM6N
+kOBQx11K0sS8VeOViPfPajXg16Hk6a1n8tdgGfUH9xtlPRN5Dq5zh3KiZzpoq65c
+FeY86qqc0FegDfwAfHjLiNdq7ApzuLcv8vGh7WN23CTXE+cCgcAhhnUawfKcOvwh
+3+Tt+vX6dBU7x+JVUiaI27zirE4dbKAsNN8MY7hT5pEwYYArtS9szWqmce3VT8dN
+t5kJdn0ZLh4tnZcWd8z+xTXjgxgKeSqoUqPjOd9V8f4ceiPeLGnDV/6xPiVdCrHi
+/R/fLidzApQKg7kGDyB1IX0gW+9mT24/zD+M52TjRdmYL6E7/1nZlNlr2JWfIdb+
+RLg/+EujuZo36hR59XQVEnvuhZFQ+MQeHC82yP4gjG0ADpLQ3cY=
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/10-unbound-anchor.tdir/keys/unbound_control.pem b/testdata/10-unbound-anchor.tdir/keys/unbound_control.pem
index ec7cd7e78..e7fe79bc3 100644
--- a/testdata/10-unbound-anchor.tdir/keys/unbound_control.pem
+++ b/testdata/10-unbound-anchor.tdir/keys/unbound_control.pem
@@ -1,14 +1,19 @@
 -----BEGIN CERTIFICATE-----
-MIICNjCCAV8CCQCbt2WrJa/ewzANBgkqhkiG9w0BAQUFADAmMQ4wDAYDVQQDEwVw
-ZXRhbDEUMBIGCSqGSIb3DQEJARYFcGV0YWwwHhcNMTMwMTE3MTE1MjQ1WhcNMzIx
-MDA0MTE1MjQ1WjAZMRcwFQYDVQQDEw51bmJvdW5kLWFuY2hvcjCB3zANBgkqhkiG
-9w0BAQEFAAOBzQAwgckCgcEAtqdDE1VRH7zqWlpSOqyyhsWh38P+CVMVwsAx0ZJM
-gdIZCEkTMfIpgfoqNGmNlHJPc5dAU4D2irRXgNPpbpGZO+ZHjrgEzxWcGwhrPuk8
-eQKDePjcyGlWsuQLjvBNbugFXZnAKgcj/kfdss+X90/d/3ErGM6j2emNcDvbGm7a
-5Bk2MJ3zIJ0rbcr5QSIUQ1mxDvq1i9ggotCba56YivLGtsrEAqvWOmYho0/TxFiG
-cJMUOsuUyFlbcoraJJ6Q4XmXAgMBAAEwDQYJKoZIhvcNAQEFBQADgcEAhc3wYcbD
-Uu9Osbu3bhbxLCkhedq/3weEO8RDU3AyB8diioAikagIOb99UeVE3WIds+JIPD6J
-mK5UvS+lPR8SEOMRd0H91bEEp1Zn+gHAS/Z7k/x9t38Xk1N0jOnElc6n4vl42KLO
-z2laJWcte7YXjzFjaNxP9fsGgEx1vRxcjtpXQWSY+oj+RVm5kRs5WKX5MCyD/p+y
-Xitg7/a0ITKbW1GpVwaX6nPaeoze68m3qmy64l080XCna3igbhi3h2ay
+MIIDBTCCAi4CFG36qDt2k02biKtMYGtLy9khnP+eMA0GCSqGSIb3DQEBBQUAMCYx
+DjAMBgNVBAMMBXBldGFsMRQwEgYJKoZIhvcNAQkBFgVwZXRhbDAeFw0yMDA3MDgx
+NDA5NDJaFw00MDAzMjUxNDA5NDJaMBkxFzAVBgNVBAMMDnVuYm91bmQtYW5jaG9y
+MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAzDESJ2lpIno7KpSrYBeB
+shT8H5dbtNF9rVBONsCmwSSqclLRixZ62OKrUKMVCEpZ0zj4yZOu3DGTfL9V9pEk
+3dCD8mFmylidYeLh5GHGMcDVWOzDVPsnQ9y43KWYeURpGy4QSCxYDb5rrPysleSZ
+wuN5D4lbs/AKdpubAHj6z37Zbrs2GjofHp6TaD6ck7jyRXDtqShrnsVXq9U1CadY
+DOPiE4aZ1TvusRzhhjmDm8GQXalrtIBJ5j5EcmRamFhONGLshfj5ECZrKo9L17kO
+d8PyRMaXNfvl2tpx1qtMxmp7FDpboGGIzP7F7hyaWMI/zAzkTMAtjGkAJWqHgTbS
+fvlVul23RLvovM3fD/ZiugBuTWY/CRpmN7CQFFV6iFyLGjRp8vV7BojUIQX7is8Q
+TxSqW12SsElMXOuUmcCnuIaoGF4nAoG6vNLFECtSdLTjQ0uXawIp7dOww4zS8j1/
+dZzXsVF4G4V7GjeWD8eX7n+HNWoc3ojjuYzbWfWvLIQbAgMBAAEwDQYJKoZIhvcN
+AQEFBQADgcEAPz9Iw956A8piiC5y3hJXAEJ0JYdNrpsgdj7n6iAXRU2EY+juzcKU
+D+zcNEcebQJJxayr4eEMfUOUO1wH5uPkWBhKOC/qm6T6i/+/xNsksOeHm12G4/vH
+VYPXTxMS+K+mz5HLmLcR0kuQMnCK22FFQj86fhr2vHBGHqINR6MxwvLCES37FWvr
+qVZSseK6/6IwRgsjN101JUpaSnM88cMDpuUcqQrAbSSBRKDvjYMkcYcYuvchab26
+G0jEU4KgxaOs
 -----END CERTIFICATE-----
diff --git a/testdata/10-unbound-anchor.tdir/keys/unbound_server.key b/testdata/10-unbound-anchor.tdir/keys/unbound_server.key
index 6614e498f..370a7bbb2 100644
--- a/testdata/10-unbound-anchor.tdir/keys/unbound_server.key
+++ b/testdata/10-unbound-anchor.tdir/keys/unbound_server.key
@@ -1,21 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIDfQIBAAKBwQC1xQ/Kca6zszZbcCtdOTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJ
-RuN+Rm304SonpwghfP2/ULZNnuDgpG03/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1
-QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ867K029ypjOQtAJ85qdO3mERy7TGtdUcu
-O6hLeVet419YeQ2F8cfNxn63d7bOzNGLPW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeU
-J/i4YDWexFYSL+ECAwEAAQKBwCLXXQl+9O+5AEhSnd1Go1Jh0pSA7eBJOuXQcebG
-Rb7ykp+6C4G2NtDziwwPRNdI6wQQQ0sym18RfyVQHydGr78/nbiIbB3HCn5e92Mh
-mefzW6ow9Kvm2txLzGKA1lvoyRbNm81jnG/eygi3u7Nqd5PNv+4dHj2RkTlmxOeh
-qnDMVP5md8uZPv6lYNnrnIzvLCR5vnPNdVwn89AqzI85IcDZdy0R9ZX4NBbsDgAU
-6ig6uXuRXvSGiyJ/OUXSrnogaQJhAOjvkHUhVZQkPOxO90TNH4j0GdKKtbSWxIdz
-lKfuJeBAEqs0TL+C6vbS81Xw3W1alyDdUBk3rJMOBqW6Ryq5HNL+j5H+Jfsh7fvc
-Yle+5wHGci0P9zCFZCrY8It7n9XFIwJhAMfEi6oJa2G8waPJ1bQhxka82Tf9pnKM
-XCn/1BBOFjVIx5F842cpA+zp5a62GENTGYPQTTRBB/2/ZwnW5aIkrlg54AtmbqBZ
-Oh+2kJdJQD/tfoVmc5soUE2ScTHadK5RKwJhAN4w9kjkXS+MSZjX0kIMsBIBVkhh
-C+aREjJqa9ir7/Ey7RvmLXdYuCxtGLRXp7/R8+rjcK49Tx6O+IRJZe042mfhbq3C
-EhS1Tr86f4xXix9EXlDhs9bSxrOgcAN9Dv/opQJhAK7eBcPaav0rVfYh/8emqQHS
-3fJ9Pu6WnzbEksWTFS2ff9KDGCx9YspIFJ5TF/oXDAaumGZdZrlgirm6O1kr8tGY
-F97i04PZl1+bWAaWQH+1TUNI43m2WFUPE7coG2tb8QJgcddDg9VlXliZqgcETZfJ
-kJmYETxrcSn3ao6v116N8yxhEgUgjkmsCTiFgx36iDVnXwK6PIt+sIu8MC7eYNa3
-berrv/M21K0LRn20IWRxvUobG070weHCAgkko7fTWgr2
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/10-unbound-anchor.tdir/keys/unbound_server.pem b/testdata/10-unbound-anchor.tdir/keys/unbound_server.pem
index 19c8b895b..986807310 100644
--- a/testdata/10-unbound-anchor.tdir/keys/unbound_server.pem
+++ b/testdata/10-unbound-anchor.tdir/keys/unbound_server.pem
@@ -1,14 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIICFzCCAUACCQDO660L5y5LGDANBgkqhkiG9w0BAQUFADAQMQ4wDAYDVQQDEwVw
-ZXRhbDAeFw0xMDA5MzAxMzQzMDFaFw0zMDA2MTcxMzQzMDFaMBAxDjAMBgNVBAMT
-BXBldGFsMIHfMA0GCSqGSIb3DQEBAQUAA4HNADCByQKBwQC1xQ/Kca6zszZbcCtd
-OTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJRuN+Rm304SonpwghfP2/ULZNnuDgpG03
-/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ8
-67K029ypjOQtAJ85qdO3mERy7TGtdUcuO6hLeVet419YeQ2F8cfNxn63d7bOzNGL
-PW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeUJ/i4YDWexFYSL+ECAwEAATANBgkqhkiG
-9w0BAQUFAAOBwQBBkX9KDP2RXbg+xPmdJ4P6CwvA5x1LZwC++ydVx4NlvT0pWicD
-ZUnXjcWAJlkeOuUBAqFG7WHTrXpUUAjmdqFVq2yFjteUYBdrFz0RDB2jM9feeKYO
-mTgxdZyT9a6humxCxt5VfgT02axLjm/2AqCyFPMbf4PASoJDln01AEuZLZ8Xl2gV
-bYHMnHTGoD1Hu6FNEzRgkMC6XT8X3YjHvzQhpc/qL5wEfEsinQGdX4twsuWbf8xd
-q7miNnkO8vd0maw=
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/ctrl_itr.tdir/unbound_control.key b/testdata/ctrl_itr.tdir/unbound_control.key
index d7c43a06b..753a4ef61 100644
--- a/testdata/ctrl_itr.tdir/unbound_control.key
+++ b/testdata/ctrl_itr.tdir/unbound_control.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
-rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
-ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
-AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
-WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
-DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
-4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
-Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
-p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
-P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
-aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
-YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
-DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/ctrl_itr.tdir/unbound_control.pem b/testdata/ctrl_itr.tdir/unbound_control.pem
index 8f1ba87f1..a1edf7017 100644
--- a/testdata/ctrl_itr.tdir/unbound_control.pem
+++ b/testdata/ctrl_itr.tdir/unbound_control.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
-AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
-6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
-qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
-J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
-9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
-iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
 -----END CERTIFICATE-----
diff --git a/testdata/ctrl_itr.tdir/unbound_server.key b/testdata/ctrl_itr.tdir/unbound_server.key
index 4256c421d..370a7bbb2 100644
--- a/testdata/ctrl_itr.tdir/unbound_server.key
+++ b/testdata/ctrl_itr.tdir/unbound_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/ctrl_itr.tdir/unbound_server.pem b/testdata/ctrl_itr.tdir/unbound_server.pem
index aeda3ff11..986807310 100644
--- a/testdata/ctrl_itr.tdir/unbound_server.pem
+++ b/testdata/ctrl_itr.tdir/unbound_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
-y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
-/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
-g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
-9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
-l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
-Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/ctrl_pipe.tdir/unbound_control.key b/testdata/ctrl_pipe.tdir/unbound_control.key
index d7c43a06b..753a4ef61 100644
--- a/testdata/ctrl_pipe.tdir/unbound_control.key
+++ b/testdata/ctrl_pipe.tdir/unbound_control.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
-rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
-ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
-AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
-WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
-DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
-4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
-Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
-p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
-P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
-aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
-YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
-DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/ctrl_pipe.tdir/unbound_control.pem b/testdata/ctrl_pipe.tdir/unbound_control.pem
index 8f1ba87f1..a1edf7017 100644
--- a/testdata/ctrl_pipe.tdir/unbound_control.pem
+++ b/testdata/ctrl_pipe.tdir/unbound_control.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
-AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
-6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
-qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
-J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
-9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
-iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
 -----END CERTIFICATE-----
diff --git a/testdata/ctrl_pipe.tdir/unbound_server.key b/testdata/ctrl_pipe.tdir/unbound_server.key
index 4256c421d..370a7bbb2 100644
--- a/testdata/ctrl_pipe.tdir/unbound_server.key
+++ b/testdata/ctrl_pipe.tdir/unbound_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/ctrl_pipe.tdir/unbound_server.pem b/testdata/ctrl_pipe.tdir/unbound_server.pem
index aeda3ff11..986807310 100644
--- a/testdata/ctrl_pipe.tdir/unbound_server.pem
+++ b/testdata/ctrl_pipe.tdir/unbound_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
-y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
-/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
-g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
-9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
-l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
-Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/dlv_anchor.rpl b/testdata/dlv_anchor.rpl
deleted file mode 100644
index 81547454e..000000000
--- a/testdata/dlv_anchor.rpl
+++ /dev/null
@@ -1,279 +0,0 @@
-; config options
-; The island of trust is at example.com (the DLV repository)
-server:
-	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-	minimal-responses: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator with DLV anchor
-; positive response for DLV.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; DLV query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net.example.com. IN DLV
-SECTION ANSWER
-example.net.example.com.	3600	IN	DLV	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-example.net.example.com.	3600	IN	RRSIG	DLV 3 4 3600 20070926134150 20070829134150 2854 example.com. ACK48Q/oKwh/SM9yRiKjZYuc+AtEZ2yCPNJ15kKCN8nsVcv7xigmNTY= ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-com.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-; DS RR is
-; example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-; DNSKEY prime query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; www.example.net query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.net. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-SCENARIO_END
diff --git a/testdata/dlv_ask_higher.rpl b/testdata/dlv_ask_higher.rpl
deleted file mode 100644
index fad8355c8..000000000
--- a/testdata/dlv_ask_higher.rpl
+++ /dev/null
@@ -1,354 +0,0 @@
-; config options
-; The island of trust is at example.com (the DLV repository)
-server:
-	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-	minimal-responses: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator with DLV where it needs to ask higher up in dlv.
-; at first negative DLV response, it needs to ask higher.
-; the SOA record in that negative response has a big span (if interpreted as NSEC)
-; then a positive response for DLV.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; failed DLV query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NXDOMAIN
-SECTION QUESTION
-sub.example.net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.net.example.com IN NSEC not.example.com. RRSIG NSEC DLV
-example.net.example.com.	3600	IN	RRSIG	NSEC 3 4 3600 20070926134150 20070829134150 2854 example.com. AKz/e6KOw8gCx6wnpIatBwKb0WOPBTWmNNMg91XR/wlJQ9Z2+qICPmA= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-SECTION ADDITIONAL
-ENTRY_END
-
-; DLV query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net.example.com. IN DLV
-SECTION ANSWER
-example.net.example.com.	3600	IN	DLV	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-example.net.example.com.	3600	IN	RRSIG	DLV 3 4 3600 20070926134150 20070829134150 2854 example.com. ACK48Q/oKwh/SM9yRiKjZYuc+AtEZ2yCPNJ15kKCN8nsVcv7xigmNTY= ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-com.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-; DS RR is
-; example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-; DNSKEY prime query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; www.sub.example.net query
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.net. IN A
-SECTION ANSWER
-SECTION AUTHORITY
-sub.example.net.    IN NS   ns.sub.example.net.
-sub.example.net.	3600	IN	DS	30899 5 1 36b39460f94a807cbbbf3b31cc9db955081b2b36 ; xetir-fahok-bovug-pebyl-sovur-zyvaf-cufan-tivih-hadec-rypof-kixox
-sub.example.net.	3600	IN	RRSIG	DS 5 3 3600 20070926134150 20070829134150 30899 example.net. nM5HAlRsrLurc5mUNKwCye5X6LSH53pLgSeyni4wb6Jd2J48ZRWwrVvy7IpyvI75+Wlu3aGOjv/kEyVaizChRQ== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.net.         IN      A       1.2.3.6
-ENTRY_END
-
-RANGE_END
-
-; ns.sub.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.6
-; DS
-; sub.example.net.	3600	IN	DS	30899 5 1 36b39460f94a807cbbbf3b31cc9db955081b2b36 ; xetir-fahok-bovug-pebyl-sovur-zyvaf-cufan-tivih-hadec-rypof-kixox
-; DNSKEY prime query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.net. IN DNSKEY
-SECTION ANSWER
-sub.example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-sub.example.net.	3600	IN	RRSIG	DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. PATh0K1jz9QeN02C79noX9gwK+Nr5VznWPQwygm/pYDsOb0z3EsaiOrzyoreegDKgoNn3kN0CywS+usCWM6hrw== ;{id = 30899}
-SECTION AUTHORITY
-sub.example.net.    IN NS   ns.sub.example.net.
-sub.example.net.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. JZUK303aE7R428S5XXLaowpM79YSc2g7wy2rDOH+6Ts2UefZInv6X5cjJU4+qBrS8i9XhdllqG7SEnPKZ0GtAw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.net.         IN      A       1.2.3.6
-ns.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AluXPa4XdlCysQMVrt0YairoOug4GMvy8rNUeKLCfQ5xVqRMqkTisbzJXBQPgYEVA0DJR74eEpgLrcz5ztb1aA== ;{id = 30899}
-ENTRY_END
-
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.net. IN NS
-SECTION ANSWER
-sub.example.net.    IN NS   ns.sub.example.net.
-sub.example.net.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. JZUK303aE7R428S5XXLaowpM79YSc2g7wy2rDOH+6Ts2UefZInv6X5cjJU4+qBrS8i9XhdllqG7SEnPKZ0GtAw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.net.         IN      A       1.2.3.6
-ns.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AluXPa4XdlCysQMVrt0YairoOug4GMvy8rNUeKLCfQ5xVqRMqkTisbzJXBQPgYEVA0DJR74eEpgLrcz5ztb1aA== ;{id = 30899}
-ENTRY_END
-
-; www.sub.example.net query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.sub.example.net. IN A
-SECTION ANSWER
-www.sub.example.net.	3600	IN	A	10.20.30.40
-www.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. Q+88AIM3K8q6S0bHeFVT742EepZFxOxgtaL1V68DEkP4NePKzL4zttWQD3uI/5ALw/fIrC7G43Eo+epWn2ZGCA== ;{id = 30899}
-SECTION AUTHORITY
-sub.example.net.    IN NS   ns.sub.example.net.
-sub.example.net.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. JZUK303aE7R428S5XXLaowpM79YSc2g7wy2rDOH+6Ts2UefZInv6X5cjJU4+qBrS8i9XhdllqG7SEnPKZ0GtAw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.net.         IN      A       1.2.3.6
-ns.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AluXPa4XdlCysQMVrt0YairoOug4GMvy8rNUeKLCfQ5xVqRMqkTisbzJXBQPgYEVA0DJR74eEpgLrcz5ztb1aA== ;{id = 30899}
-ENTRY_END
-
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.sub.example.net. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-www.sub.example.net. IN A
-SECTION ANSWER
-www.sub.example.net.	3600	IN	A	10.20.30.40
-www.sub.example.net.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. Q+88AIM3K8q6S0bHeFVT742EepZFxOxgtaL1V68DEkP4NePKzL4zttWQD3uI/5ALw/fIrC7G43Eo+epWn2ZGCA== ;{id = 30899}
-SECTION AUTHORITY
-sub.example.net.    IN NS   ns.sub.example.net.
-sub.example.net.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. JZUK303aE7R428S5XXLaowpM79YSc2g7wy2rDOH+6Ts2UefZInv6X5cjJU4+qBrS8i9XhdllqG7SEnPKZ0GtAw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.net.         IN      A       1.2.3.6
-ns.sub.example.net.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AluXPa4XdlCysQMVrt0YairoOug4GMvy8rNUeKLCfQ5xVqRMqkTisbzJXBQPgYEVA0DJR74eEpgLrcz5ztb1aA== ;{id = 30899}
-ENTRY_END
-
-SCENARIO_END
diff --git a/testdata/dlv_below_ta.rpl b/testdata/dlv_below_ta.rpl
deleted file mode 100644
index f5d630dfb..000000000
--- a/testdata/dlv_below_ta.rpl
+++ /dev/null
@@ -1,355 +0,0 @@
-; config options
-; The island of trust is at example.com (the DLV repository)
-server:
-	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	trust-anchor: "example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-	minimal-responses: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator, use DLV for nonDSed zone below trustanchor.
-; DLV example.com.
-; trust anchor at example.net but no secure delegation to
-; sub.example.net  signed with DLV but not by parent.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; DLV query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.net.example.com. IN DLV
-SECTION ANSWER
-sub.example.net.example.com.	3600	IN	DLV	30899 5 1 36b39460f94a807cbbbf3b31cc9db955081b2b36 ; xetir-fahok-bovug-pebyl-sovur-zyvaf-cufan-tivih-hadec-rypof-kixox
-sub.example.net.example.com.	3600	IN	RRSIG	DLV 3 5 3600 20070926135752 20070829135752 2854 example.com. AAdhy87nuDEaxmc+k9pJHYnhKiEYL++OLPxzOdwEQOtsHi7jeD3lRDU= ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC sub.example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. ALITtZY03PDWnuAeEL/5VwMIXY3iC2y7Qkeq5DgAHmPbNyWiOmJNEKg= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-com.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC sub.example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. ALITtZY03PDWnuAeEL/5VwMIXY3iC2y7Qkeq5DgAHmPbNyWiOmJNEKg= ;{id = 2854}
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-; DS RR is
-; example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-; DNSKEY prime query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; no DS to sub.example.net, securely insecure.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id 
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.net. IN DS
-SECTION ANSWER
-SECTION AUTHORITY
-example.net. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.net.	3600	IN	RRSIG	SOA 5 2 3600 20070926134150 20070829134150 30899 example.net. ELVULZHTRc0Qk06rSBRnB/T6sm1+AbAtdEJHN6PCsz2Z3s3E5A8NH7Krz0VzRaYIEUStnbAtuE3oP8XHWHBnyQ== ;{id = 30899}
-sub.example.net.	IN NSEC tut.example.net. NS NSEC
-sub.example.net.	3600	IN	RRSIG	NSEC 5 3 3600 20070926134150 20070829134150 30899 example.net. eNJ2OPjMhGKvg70aYT9l9Uo1lJsqmDqVRMlHibv6t+CNjljytI9Vwbao17oV0cjIksmESAewReb73x9fmVIgEQ== ;{id = 30899}
-SECTION ADDITIONAL
-ENTRY_END
-
-; delegation to sub.example.net, securely insecure.
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.net. IN NS
-SECTION ANSWER
-SECTION AUTHORITY
-sub.example.net.    IN NS   ns.sub.example.net.
-sub.example.net.	IN NSEC tut.example.net. NS NSEC
-sub.example.net.	3600	IN	RRSIG	NSEC 5 3 3600 20070926134150 20070829134150 30899 example.net. eNJ2OPjMhGKvg70aYT9l9Uo1lJsqmDqVRMlHibv6t+CNjljytI9Vwbao17oV0cjIksmESAewReb73x9fmVIgEQ== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.net.         IN      A       1.2.3.6
-ENTRY_END
-
-
-RANGE_END
-
-; ns.sub.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.6
-; DS is
-; sub.example.net.	3600	IN	DS	30899 5 1 36b39460f94a807cbbbf3b31cc9db955081b2b36 ; xetir-fahok-bovug-pebyl-sovur-zyvaf-cufan-tivih-hadec-rypof-kixox
-; DNSKEY query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-sub.example.net. IN DNSKEY
-SECTION ANSWER
-sub.example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-sub.example.net.	3600	IN	RRSIG	DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. PATh0K1jz9QeN02C79noX9gwK+Nr5VznWPQwygm/pYDsOb0z3EsaiOrzyoreegDKgoNn3kN0CywS+usCWM6hrw== ;{id = 30899}
-SECTION AUTHORITY
-sub.example.net.    IN NS   ns.sub.example.net.
-sub.example.net.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. JZUK303aE7R428S5XXLaowpM79YSc2g7wy2rDOH+6Ts2UefZInv6X5cjJU4+qBrS8i9XhdllqG7SEnPKZ0GtAw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.net.         IN      A       1.2.3.6
-ns.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AluXPa4XdlCysQMVrt0YairoOug4GMvy8rNUeKLCfQ5xVqRMqkTisbzJXBQPgYEVA0DJR74eEpgLrcz5ztb1aA== ;{id = 30899}
-ENTRY_END
-
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-sub.example.net. IN NS
-SECTION ANSWER
-sub.example.net.    IN NS   ns.sub.example.net.
-sub.example.net.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. JZUK303aE7R428S5XXLaowpM79YSc2g7wy2rDOH+6Ts2UefZInv6X5cjJU4+qBrS8i9XhdllqG7SEnPKZ0GtAw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.net.         IN      A       1.2.3.6
-ns.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AluXPa4XdlCysQMVrt0YairoOug4GMvy8rNUeKLCfQ5xVqRMqkTisbzJXBQPgYEVA0DJR74eEpgLrcz5ztb1aA== ;{id = 30899}
-ENTRY_END
-
-; www.sub.example.net query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-www.sub.example.net. IN A
-SECTION ANSWER
-www.sub.example.net. IN A 10.20.30.40
-www.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. Q+88AIM3K8q6S0bHeFVT742EepZFxOxgtaL1V68DEkP4NePKzL4zttWQD3uI/5ALw/fIrC7G43Eo+epWn2ZGCA== ;{id = 30899}
-SECTION AUTHORITY
-sub.example.net.    IN NS   ns.sub.example.net.
-sub.example.net.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. JZUK303aE7R428S5XXLaowpM79YSc2g7wy2rDOH+6Ts2UefZInv6X5cjJU4+qBrS8i9XhdllqG7SEnPKZ0GtAw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.net.         IN      A       1.2.3.6
-ns.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AluXPa4XdlCysQMVrt0YairoOug4GMvy8rNUeKLCfQ5xVqRMqkTisbzJXBQPgYEVA0DJR74eEpgLrcz5ztb1aA== ;{id = 30899}
-ENTRY_END
-
-
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.sub.example.net. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-www.sub.example.net. IN A
-SECTION ANSWER
-www.sub.example.net. IN A 10.20.30.40
-www.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. Q+88AIM3K8q6S0bHeFVT742EepZFxOxgtaL1V68DEkP4NePKzL4zttWQD3uI/5ALw/fIrC7G43Eo+epWn2ZGCA== ;{id = 30899}
-SECTION AUTHORITY
-sub.example.net.    IN NS   ns.sub.example.net.
-sub.example.net.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. JZUK303aE7R428S5XXLaowpM79YSc2g7wy2rDOH+6Ts2UefZInv6X5cjJU4+qBrS8i9XhdllqG7SEnPKZ0GtAw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.net.         IN      A       1.2.3.6
-ns.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AluXPa4XdlCysQMVrt0YairoOug4GMvy8rNUeKLCfQ5xVqRMqkTisbzJXBQPgYEVA0DJR74eEpgLrcz5ztb1aA== ;{id = 30899}
-ENTRY_END
-
-SCENARIO_END
diff --git a/testdata/dlv_delegation.rpl b/testdata/dlv_delegation.rpl
deleted file mode 100644
index 53074c8e2..000000000
--- a/testdata/dlv_delegation.rpl
+++ /dev/null
@@ -1,335 +0,0 @@
-; config options
-; The island of trust is at example.com (the DLV repository)
-server:
-	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-	minimal-responses: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator with delegation in DLV repository
-; positive response for DLV.
-; but the DLV repository has a (secure) delegation inside it.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; referral to the net.example.com DLV server
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-net.example.com. NS ns.net.example.com.
-net.example.com.	3600	IN	DS	2854 3 1 24d80cd822bc4083cf491b7f055890345a77dd9b ; xenat-myfat-memir-sabym-fefig-nakol-zucyh-megef-gakel-lolyn-ruxox
-net.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AA0APyTN12wzj1XmDEZe+wrPE1hkLAINKT8cT9zGup7zX3O8R4Ki2N8= ;{id = 2854}
-SECTION ADDITIONAL
-ns.net.example.com. A 1.2.3.6
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-com.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AJEvfI+tX6Y1OF0h1CNHERJjXaaTsmLWTMLgXk4UYJl8JjAikCpsf9Q= ;{id = 2854}
-ENTRY_END
-
-RANGE_END
-
-; ns.net.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.6
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net.example.com. IN NS
-SECTION ANSWER
-net.example.com. NS ns.net.example.com.
-net.example.com.	3600	IN	RRSIG	NS 3 3 3600 20070926134150 20070829134150 2854 net.example.com. AHjTvB20SzZVV9P3LXJ6lVzFWCoDk7T71VHllOwmom3a/EutlUpsgNM= ;{id = 2854}
-SECTION ADDITIONAL
-ns.net.example.com. A 1.2.3.6
-ns.net.example.com.	3600	IN	RRSIG	A 3 4 3600 20070926134150 20070829134150 2854 net.example.com. AE2wjNCJayCBi6e8QAGwgujdMC2LbVWQVbQCuQx+grjoQJXQxxpFB5I= ;{id = 2854}
-ENTRY_END
-
-; DNSKEY query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net.example.com. IN DNSKEY
-SECTION ANSWER
-net.example.com.        3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJIIs70j+sDS/UT2QRp61SE7S3EEXopNXoFE73JLRmvpi/UrOO/Vz4Se6wXv/CYCKjGw06U4WRgRYXcpEhJROyNapmdIKSxhOzfLVE1gqA0PweZR8dtY3aNQSRn3sPpwJr6Mi/PqQKAMMrZ9ckJpf1+bQMOOvxgzz2U1GS18b3yZKcgTMEaJzd/GZYzi/BN2DzQ0MsrSwYXfsNLFOBbs8PJMW4LYIxeeOe6rUgkWOF7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-net.example.com.	3600	IN	RRSIG	DNSKEY 3 3 3600 20070926134150 20070829134150 2854 net.example.com. ADgKDV1Yi2iFOXFUN1XkvBU7KW/rdtGcOEdc9VMIxfIKDo5h24E5fqs= ;{id = 2854}
-SECTION AUTHORITY
-net.example.com. NS ns.net.example.com.
-net.example.com.	3600	IN	RRSIG	NS 3 3 3600 20070926134150 20070829134150 2854 net.example.com. AHjTvB20SzZVV9P3LXJ6lVzFWCoDk7T71VHllOwmom3a/EutlUpsgNM= ;{id = 2854}
-SECTION ADDITIONAL
-ns.net.example.com. A 1.2.3.6
-ns.net.example.com.	3600	IN	RRSIG	A 3 4 3600 20070926134150 20070829134150 2854 net.example.com. AE2wjNCJayCBi6e8QAGwgujdMC2LbVWQVbQCuQx+grjoQJXQxxpFB5I= ;{id = 2854}
-ENTRY_END
-
-; DLV apex
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-net.example.com. SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-net.example.com.	3600	IN	RRSIG	SOA 3 3 3600 20070926134150 20070829134150 2854 net.example.com. AKAjedAeGWRHaqhDhNhbTvVUQMgCspiD4GNC7dMVbEZSd87AFcqwg1Y= ;{id = 2854}
-net.example.com. NSEC example.net.example.com. SOA NS DNSKEY RRSIG NSEC
-net.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20070926134150 20070829134150 2854 net.example.com. AAHqj3xDqng7ZuNFn89sTjTo2qfuXTv0yR6v8mZ1+L5mCsOwjpGXrJw= ;{id = 2854}
-SECTION ADDITIONAL
-ENTRY_END
-
-; DLV of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net.example.com. IN DLV
-SECTION ANSWER
-example.net.example.com.        3600    IN      DLV     30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-example.net.example.com.	3600	IN	RRSIG	DLV 3 4 3600 20070926134150 20070829134150 2854 net.example.com. AIZmoTbAlXYwLknm84i7sbglbHr1Iq7t0yyTENO/MsPj7K/mvEQAI/g= ;{id = 2854}
-SECTION AUTHORITY
-net.example.com. NS ns.net.example.com.
-net.example.com.	3600	IN	RRSIG	NS 3 3 3600 20070926134150 20070829134150 2854 net.example.com. AHjTvB20SzZVV9P3LXJ6lVzFWCoDk7T71VHllOwmom3a/EutlUpsgNM= ;{id = 2854}
-SECTION ADDITIONAL
-ns.net.example.com. A 1.2.3.6
-ns.net.example.com.	3600	IN	RRSIG	A 3 4 3600 20070926134150 20070829134150 2854 net.example.com. AE2wjNCJayCBi6e8QAGwgujdMC2LbVWQVbQCuQx+grjoQJXQxxpFB5I= ;{id = 2854}
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-; DS RR is
-; example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-; DNSKEY prime query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; www.example.net query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.net. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-SCENARIO_END
diff --git a/testdata/dlv_ds_lookup.rpl b/testdata/dlv_ds_lookup.rpl
deleted file mode 100644
index 663cd9c36..000000000
--- a/testdata/dlv_ds_lookup.rpl
+++ /dev/null
@@ -1,281 +0,0 @@
-; config options
-; The island of trust is at example.com (the DLV repository)
-server:
-	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator with DLV anchor for a DS lookup.
-; positive response for DLV.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DS
-SECTION AUTHORITY
-net.			900	IN	SOA	a.gtld-servers.net. nstld.verisign-grs.com. 1251367385 1800 900 604800 86400
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; DLV query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net.example.com. IN DLV
-SECTION ANSWER
-example.net.example.com.	3600	IN	DLV	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-example.net.example.com.	3600	IN	RRSIG	DLV 3 4 3600 20070926134150 20070829134150 2854 example.com. ACK48Q/oKwh/SM9yRiKjZYuc+AtEZ2yCPNJ15kKCN8nsVcv7xigmNTY= ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-com.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-; DS RR is
-; example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-; DNSKEY prime query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; www.example.net query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-example.net. IN DS
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA DO NOERROR
-SECTION QUESTION
-example.net. IN DS
-SECTION AUTHORITY
-net.			900	IN	SOA	a.gtld-servers.net. nstld.verisign-grs.com. 1251367385 1800 900 604800 86400
-ENTRY_END
-
-SCENARIO_END
diff --git a/testdata/dlv_insecure.rpl b/testdata/dlv_insecure.rpl
deleted file mode 100644
index e6515a9fb..000000000
--- a/testdata/dlv_insecure.rpl
+++ /dev/null
@@ -1,254 +0,0 @@
-; config options
-; The island of trust is at example.com (the DLV repository)
-server:
-	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	harden-referral-path: no
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-	minimal-responses: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator with insecure zone with no DLV 
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; DLV query
-; could be picked out of the negative cache due to NS queries in between.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-www.example.net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-example.com IN NSEC zazz.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. AAi21jQpno6gXnrPrtK0NvNgX9B8E9U5RvTd47QiCWLF7KdtKxB7Xz0= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC zazz.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. AAi21jQpno6gXnrPrtK0NvNgX9B8E9U5RvTd47QiCWLF7KdtKxB7Xz0= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-com.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC zazz.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. AAi21jQpno6gXnrPrtK0NvNgX9B8E9U5RvTd47QiCWLF7KdtKxB7Xz0= ;{id = 2854}
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.    IN NS   ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ENTRY_END
-
-; www.example.net query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ENTRY_END
-
-
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.net. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA DO NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ENTRY_END
-
-SCENARIO_END
diff --git a/testdata/dlv_insecure_negcache.rpl b/testdata/dlv_insecure_negcache.rpl
deleted file mode 100644
index 8408870b9..000000000
--- a/testdata/dlv_insecure_negcache.rpl
+++ /dev/null
@@ -1,311 +0,0 @@
-; config options
-; The island of trust is at example.com (the DLV repository)
-server:
-	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	harden-referral-path: no
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-	minimal-responses: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator with insecure zone, no DLV from negative cache
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 300
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; DLV query
-; could be picked out of the negative cache due to NS queries in between.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-www.example.net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-zoink.name.example.com IN NSEC zazz.net.example.com. RRSIG NSEC DLV
-zoink.name.example.com. 3600    IN      RRSIG   NSEC 3 4 3600 20070926134150 20070829134150 2854 example.com. AHipxvshRHglCEN4nZCT4m/4RIj8TrCOE2AsqEoH9e+6OYSo+yuNzzo= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-zoink.name.example.com IN NSEC zazz.net.example.com. RRSIG NSEC DLV
-zoink.name.example.com. 3600    IN      RRSIG   NSEC 3 4 3600 20070926134150 20070829134150 2854 example.com. AHipxvshRHglCEN4nZCT4m/4RIj8TrCOE2AsqEoH9e+6OYSo+yuNzzo= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC frump.aqua.example.com. SOA NS RRSIG NSEC DNSKEY
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AAscY9DfNm3Uy8f8Q4WX6AzR0flHYNSr3fKfgQ0Xc20fzj1lGP9ebfk= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-com.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC zazz.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. AAi21jQpno6gXnrPrtK0NvNgX9B8E9U5RvTd47QiCWLF7KdtKxB7Xz0= ;{id = 2854}
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 300
-	ADDRESS 1.2.3.5
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.    IN NS   ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ENTRY_END
-
-; www.example.net query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	10	IN	A	10.20.30.40
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ENTRY_END
-
-
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.net. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA DO NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	10	IN	A	10.20.30.40
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ENTRY_END
-
-STEP 150 TIME_PASSES ELAPSE 30
-
-; no more DLV authority reachable
-STEP 200 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.net. IN A
-ENTRY_END
-
-STEP 210 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA DO NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	10	IN	A	10.20.30.40
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ENTRY_END
-
-STEP 220 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-net. IN NS
-ENTRY_END
-
-STEP 230 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA DO NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-SCENARIO_END
diff --git a/testdata/dlv_keyretry.rpl b/testdata/dlv_keyretry.rpl
deleted file mode 100644
index 8d477b5a5..000000000
--- a/testdata/dlv_keyretry.rpl
+++ /dev/null
@@ -1,287 +0,0 @@
-; config options
-; The island of trust is at example.com (the DLV repository)
-server:
-	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator with DLV anchor and subsequently key retries
-; positive response for DLV.  But the DNSKEY for the target fails validation.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; DLV query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net.example.com. IN DLV
-SECTION ANSWER
-example.net.example.com.	3600	IN	DLV	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-example.net.example.com.	3600	IN	RRSIG	DLV 3 4 3600 20070926134150 20070829134150 2854 example.com. ACK48Q/oKwh/SM9yRiKjZYuc+AtEZ2yCPNJ15kKCN8nsVcv7xigmNTY= ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-com.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-; DS RR is
-; example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-; DNSKEY prime query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-; expired signature
-example.net.	3600	IN	RRSIG	DNSKEY 5 2 3600 20050926134150 20050829134150 30899 example.net. ydM0/eWMqFn4RxMTbscdSLU7bJNoPuzjCa0eI7HSV/r/54slSGvkl0fmwqrROl1tpc0YMV6kAzgB1T5lJbvdsA== ;{id = 30899}
-; good signature:
-;example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; AAAA for nameserver (for dnssec retry) query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.example.net. IN AAAA
-SECTION AUTHORITY
-example.net. IN SOA . . 2007091300 28800 7200 604800 3600
-example.net.	3600	IN	RRSIG	SOA 5 2 3600 20070926134150 20070829134150 30899 example.net. MrpP4svNpbN/YKhuYRlNbvNg0yVxn4ywW1tyEFA9v6F7BR6k1pP8iPfN5XV+XWPAmbss9h3fwKq8zNs4F/SPkg== ;{id = 30899}
-ns.example.net. IN NSEC ppp.example.net. A RRSIG NSEC
-ns.example.net.	3600	IN	RRSIG	NSEC 5 3 3600 20070926134150 20070829134150 30899 example.net. freWP6rXWsU5iyRE2gIM9rICuBxCYlQSW01GkLPez5czqtEL0hHN8vtjTlfoNxjJjiZj3vAavZDIQGgOOOMIsA== ;{id = 30899}
-ENTRY_END
-
-; www.example.net query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.net. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA DO SERVFAIL
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-ENTRY_END
-
-SCENARIO_END
diff --git a/testdata/dlv_negnx.rpl b/testdata/dlv_negnx.rpl
deleted file mode 100644
index 03edf1a47..000000000
--- a/testdata/dlv_negnx.rpl
+++ /dev/null
@@ -1,405 +0,0 @@
-; config options
-; The island of trust is at example.com (the DLV repository)
-server:
-	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator with DLV anchor for negcache nxdomain proof
-; put a DLV in the negcache.
-; then test ask-higher with that in the cache.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; DLV query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net.example.com. IN DLV
-SECTION ANSWER
-example.net.example.com.	3600	IN	DLV	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-example.net.example.com.	3600	IN	RRSIG	DLV 3 4 3600 20070926134150 20070829134150 2854 example.com. ACK48Q/oKwh/SM9yRiKjZYuc+AtEZ2yCPNJ15kKCN8nsVcv7xigmNTY= ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; under example.net in DLV
-ENTRY_BEGIN
-MATCH opcode qtype subdomain
-ADJUST copy_id copy_query
-REPLY QR NXDOMAIN
-SECTION QUESTION
-example.net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.net.example.com.	3600	IN 	NSEC fru.net.example.com. RRSIG NSEC DLV
-example.net.example.com.	3600	IN	RRSIG	NSEC 3 4 3600 20070926134150 20070829134150 2854 example.com. AI6NNKt4dGcAdCrW73GYwyoqelsdj1dd8mBNPpHRQIL0yp7yYFZ7kXU= ;{id = 2854}
-example.com. IN SOA . . 1 2 3 4 5
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AIkRPbv+kZaiG61pH/wQy8fX2UqQS5YRwHaxe4yjEUXk59fgO71Db3s= ;{id = 2854}
-SECTION ADDITIONAL
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-com.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-; DS RR is
-; example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-; DNSKEY prime query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-; have it flushed out of the cache quickly.
-example.net.    0    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-example.net.    0    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; www.example.net query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; subzone
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-sub1.example.net. IN A
-SECTION ANSWER
-SECTION AUTHORITY
-sub1.example.net.	3600	IN	DS	30899 5 1 8916603e54c6f7edcfd885602e3b7b8dc475ba5c ; xodec-komif-vehis-kotav-tefot-mecyk-biryf-rivym-ticol-huvyh-saxox
-sub1.example.net.	3600	IN	RRSIG	DS 5 3 3600 20070926134150 20070829134150 30899 example.net. A3vVrEY3+oIUqdbAa3tkKaU3o47eBD01hVXfAEAue1M+Uci2PA5YyiulLzStyiP75XUXkvubLQ2+ltKMTtfdag== ;{id = 30899}
-sub1.example.net. IN NS ns.sub1.example.net.
-SECTION ADDITIONAL
-ns.sub1.example.net. IN A 1.2.3.10
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-sub2.example.net. IN A
-SECTION ANSWER
-SECTION AUTHORITY
-sub2.example.net.	3600	IN	DS	30899 5 1 627f7a51f1545133fec3ecbd19b85b92b15679c9 ; ximil-zovah-casuh-gygef-fyzas-farir-tikir-mukon-disih-kavus-nyxex
-sub2.example.net.	3600	IN	RRSIG	DS 5 3 3600 20070926134150 20070829134150 30899 example.net. azMXKt4VPHj2hk5MDU6h8E/HOtNnHnIVS6Le3BV43wtJcHG5wlCxOksOZBOpXMkpbWLvbCJOOMPOnh31nlbjgg== ;{id = 30899}
-sub2.example.net. IN NS ns.sub2.example.net.
-SECTION ADDITIONAL
-ns.sub2.example.net. IN A 1.2.3.12
-ENTRY_END
-RANGE_END
-
-; sub1.example.net.
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.10
-; DNSKEY query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub1.example.net. IN DNSKEY
-SECTION ANSWER
-sub1.example.net.       3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-sub1.example.net.	3600	IN	RRSIG	DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub1.example.net. E200eTdRnkL7/fk54i1nXEE9a/rC2GxZfVkWMU044tpwV6d4XRxVhlFBzY4FytbRFFBUDhz7L3B0qC6BXJM8rg== ;{id = 30899}
-ENTRY_END
-
-; www query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.sub1.example.net. IN A
-SECTION ANSWER
-www.sub1.example.net. IN A 192.168.1.1
-www.sub1.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub1.example.net. JKxcjPjc/TsQmUmCYHLQa3cBk1c+SbDPtVml69nDWC167NNWG8OLjLrLtUBVCfbTzCmqOWXq2qhrGPxjO65GCQ== ;{id = 30899}
-ENTRY_END
-
-RANGE_END
-
-; sub2.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.12
-; DNSKEY query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub2.example.net. IN DNSKEY
-SECTION ANSWER
-sub2.example.net.       3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-sub2.example.net.	3600	IN	RRSIG	DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub2.example.net. VcNaPuz9Mmjj5ofZqOa4FsixBomFJTjd/9wxhZOVdxf1LsNR5L++8k09gQvnjtCvqSPfNer/uv0xl+9sRr8Wmw== ;{id = 30899}
-ENTRY_END
-
-; www query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.sub2.example.net. IN A
-SECTION ANSWER
-www.sub2.example.net. IN A 192.168.1.12
-www.sub2.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub2.example.net. PsWY6+5/0+hsTOhNak/jdSeG44hvHgX5az1Q5XY/YkIchsflH9rmvP1EruFhflNhRR+22M7POiljYOoD5ylQXQ== ;{id = 30899}
-ENTRY_END
-
-RANGE_END
-
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.sub1.example.net. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-www.sub1.example.net. IN A
-SECTION ANSWER
-www.sub1.example.net. IN A 192.168.1.1
-www.sub1.example.net.   3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub1.example.net. JKxcjPjc/TsQmUmCYHLQa3cBk1c+SbDPtVml69nDWC167NNWG8OLjLrLtUBVCfbTzCmqOWXq2qhrGPxjO65GCQ== ;{id = 30899}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-; have example.net DNSKEY time out
-STEP 14 TIME_PASSES ELAPSE 1.0
-
-STEP 20 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.sub2.example.net. IN A
-ENTRY_END
-
-STEP 30 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-www.sub2.example.net. IN A
-SECTION ANSWER
-www.sub2.example.net. IN A 192.168.1.12
-www.sub2.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub2.example.net. PsWY6+5/0+hsTOhNak/jdSeG44hvHgX5az1Q5XY/YkIchsflH9rmvP1EruFhflNhRR+22M7POiljYOoD5ylQXQ== ;{id = 30899}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-
-SCENARIO_END
diff --git a/testdata/dlv_optout.rpl b/testdata/dlv_optout.rpl
deleted file mode 100644
index e5a8fdd62..000000000
--- a/testdata/dlv_optout.rpl
+++ /dev/null
@@ -1,440 +0,0 @@
-; config options
-; The island of trust is at example.com (the DLV repository)
-server:
-	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	trust-anchor: "example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator, DLV to zone below optout, check negative cache.
-; DLV example.com.
-; trust anchor at example.net but no secure delegation to
-; sub.example.net  signed with DLV but not by parent.
-; parent uses optout NSEC3.
-; then a signed delegation to down.sub.example.net.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; DLV query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.net.example.com. IN DLV
-SECTION ANSWER
-sub.example.net.example.com.	3600	IN	DLV	30899 5 1 36b39460f94a807cbbbf3b31cc9db955081b2b36 ; xetir-fahok-bovug-pebyl-sovur-zyvaf-cufan-tivih-hadec-rypof-kixox
-sub.example.net.example.com.	3600	IN	RRSIG	DLV 3 5 3600 20070926135752 20070829135752 2854 example.com. AAdhy87nuDEaxmc+k9pJHYnhKiEYL++OLPxzOdwEQOtsHi7jeD3lRDU= ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-down.sub.example.net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-sub.example.net.example.com. IN NSEC zzz.example.net.example.com. RRSIG NSEC DLV
-sub.example.net.example.com.	3600	IN	RRSIG	NSEC 3 5 3600 20070926134150 20070829134150 2854 example.com. AG/M+H/lex1CMTIuO+JpdmTjCzt7XBsLtRLPDfYTykhxnnECzZwkMnQ= ;{id = 2854}
-SECTION ADDITIONAL
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC sub.example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. ALITtZY03PDWnuAeEL/5VwMIXY3iC2y7Qkeq5DgAHmPbNyWiOmJNEKg= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-com.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC sub.example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. ALITtZY03PDWnuAeEL/5VwMIXY3iC2y7Qkeq5DgAHmPbNyWiOmJNEKg= ;{id = 2854}
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-; DS RR is
-; example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-; DNSKEY prime query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; no DS to sub.example.net, optout NSEC3.
-; NSEC3PARAM 1 1 31 DE15C001
-; example.net. 		-> hk4jq0lg6q3bt992urc88dqten1k2be8.
-; sub.example.net. 	-> ecs17hqd0kf7dk9g1cjvevj25pginrf2.
-; *.example.net. 	-> 1tgbedpeeuubbsejh2dqvso62f8n4dk1.
-; down.sub.example.net. -> 9j1r8re9b1238vd907tilclgat1i0fre.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id 
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.net. IN DS
-SECTION ANSWER
-SECTION AUTHORITY
-example.net. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.net.	3600	IN	RRSIG	SOA 5 2 3600 20070926134150 20070829134150 30899 example.net. ELVULZHTRc0Qk06rSBRnB/T6sm1+AbAtdEJHN6PCsz2Z3s3E5A8NH7Krz0VzRaYIEUStnbAtuE3oP8XHWHBnyQ== ;{id = 30899}
-; CE is example.net
-hk4jq0lg6q3bt992urc88dqten1k2be8.example.net. IN NSEC3 1 1 31 DE15C001 hl4jq0lg6q3bt992urc88dqten1k2be8 NS SOA NAPTR RRSIG DNSKEY NSEC3PARAM
-hk4jq0lg6q3bt992urc88dqten1k2be8.example.net.	3600	IN	RRSIG	NSEC3 5 3 3600 20070926134150 20070829134150 30899 example.net. n1dQKbRoB+X4K003RAhdUp6ZUP5dCiwQi+apGfLII8wmCUmw/cKiz7/Ijhs/+88hZwq/7yhlZM0D/yqAUKUiAA== ;{id = 30899}
-; NC covers sub.example.net
-ebs17hqd0kf7dk9g1cjvevj25pginrf2.example.net. IN NSEC3 1 1 31 de15c001 efs17hqd0kf7dk9g1cjvevj25pginrf2 A RRSIG
-ebs17hqd0kf7dk9g1cjvevj25pginrf2.example.net.	3600	IN	RRSIG	NSEC3 5 3 3600 20070926134150 20070829134150 30899 example.net. oSVB7Dyp7/yaOlT8AFwBJZdqwRRSQ8XFzCpu1AP51JPIuhCg5byepdvY6UC3xXc7YVO6h74tpxFCGqLpRXwDoQ== ;{id = 30899}
-SECTION ADDITIONAL
-ENTRY_END
-
-; delegation to sub.example.net, optout NSEC3.
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.net. IN NS
-SECTION ANSWER
-SECTION AUTHORITY
-sub.example.net.    IN NS   ns.sub.example.net.
-hk4jq0lg6q3bt992urc88dqten1k2be8.example.net. IN NSEC3 1 1 31 DE15C001 hl4jq0lg6q3bt992urc88dqten1k2be8 NS SOA NAPTR RRSIG DNSKEY NSEC3PARAM
-hk4jq0lg6q3bt992urc88dqten1k2be8.example.net.	3600	IN	RRSIG	NSEC3 5 3 3600 20070926134150 20070829134150 30899 example.net. n1dQKbRoB+X4K003RAhdUp6ZUP5dCiwQi+apGfLII8wmCUmw/cKiz7/Ijhs/+88hZwq/7yhlZM0D/yqAUKUiAA== ;{id = 30899}
-ebs17hqd0kf7dk9g1cjvevj25pginrf2.example.net. IN NSEC3 1 1 31 de15c001 efs17hqd0kf7dk9g1cjvevj25pginrf2 A RRSIG
-ebs17hqd0kf7dk9g1cjvevj25pginrf2.example.net.	3600	IN	RRSIG	NSEC3 5 3 3600 20070926134150 20070829134150 30899 example.net. oSVB7Dyp7/yaOlT8AFwBJZdqwRRSQ8XFzCpu1AP51JPIuhCg5byepdvY6UC3xXc7YVO6h74tpxFCGqLpRXwDoQ== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.net.         IN      A       1.2.3.6
-ENTRY_END
-
-
-RANGE_END
-
-; ns.sub.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.6
-; DS is
-; sub.example.net.	3600	IN	DS	30899 5 1 36b39460f94a807cbbbf3b31cc9db955081b2b36 ; xetir-fahok-bovug-pebyl-sovur-zyvaf-cufan-tivih-hadec-rypof-kixox
-; DNSKEY query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-sub.example.net. IN DNSKEY
-SECTION ANSWER
-sub.example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-sub.example.net.	3600	IN	RRSIG	DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. PATh0K1jz9QeN02C79noX9gwK+Nr5VznWPQwygm/pYDsOb0z3EsaiOrzyoreegDKgoNn3kN0CywS+usCWM6hrw== ;{id = 30899}
-SECTION AUTHORITY
-sub.example.net.    IN NS   ns.sub.example.net.
-sub.example.net.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. JZUK303aE7R428S5XXLaowpM79YSc2g7wy2rDOH+6Ts2UefZInv6X5cjJU4+qBrS8i9XhdllqG7SEnPKZ0GtAw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.net.         IN      A       1.2.3.6
-ns.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AluXPa4XdlCysQMVrt0YairoOug4GMvy8rNUeKLCfQ5xVqRMqkTisbzJXBQPgYEVA0DJR74eEpgLrcz5ztb1aA== ;{id = 30899}
-ENTRY_END
-
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-sub.example.net. IN NS
-SECTION ANSWER
-sub.example.net.    IN NS   ns.sub.example.net.
-sub.example.net.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. JZUK303aE7R428S5XXLaowpM79YSc2g7wy2rDOH+6Ts2UefZInv6X5cjJU4+qBrS8i9XhdllqG7SEnPKZ0GtAw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.net.         IN      A       1.2.3.6
-ns.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AluXPa4XdlCysQMVrt0YairoOug4GMvy8rNUeKLCfQ5xVqRMqkTisbzJXBQPgYEVA0DJR74eEpgLrcz5ztb1aA== ;{id = 30899}
-ENTRY_END
-
-; www.sub.example.net query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-www.sub.example.net. IN A
-SECTION ANSWER
-www.sub.example.net. IN A 10.20.30.40
-www.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. Q+88AIM3K8q6S0bHeFVT742EepZFxOxgtaL1V68DEkP4NePKzL4zttWQD3uI/5ALw/fIrC7G43Eo+epWn2ZGCA== ;{id = 30899}
-SECTION AUTHORITY
-sub.example.net.    IN NS   ns.sub.example.net.
-sub.example.net.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. JZUK303aE7R428S5XXLaowpM79YSc2g7wy2rDOH+6Ts2UefZInv6X5cjJU4+qBrS8i9XhdllqG7SEnPKZ0GtAw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.net.         IN      A       1.2.3.6
-ns.sub.example.net.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AluXPa4XdlCysQMVrt0YairoOug4GMvy8rNUeKLCfQ5xVqRMqkTisbzJXBQPgYEVA0DJR74eEpgLrcz5ztb1aA== ;{id = 30899}
-ENTRY_END
-
-; DS for down.sub.example.net
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-down.sub.example.net. IN DS
-SECTION ANSWER
-down.sub.example.net.   3600    IN      DS      60946 5 1 c636304ab7cdb6272215aceac95a8d312ac7a4f6 
-down.sub.example.net.	3600	IN	RRSIG	DS 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AMc8J534UF2+0PtPSNBw6RzN4Q5gXfnBXiUfpuT/MR1YtOE/5AP/0dTgvqvKRiFZx3NjOPeZmRnaabxkw0Qzrw== ;{id = 30899}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-; delegation to down.sub.example.net
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-down.sub.example.net. IN NS
-SECTION ANSWER
-SECTION AUTHORITY
-down.sub.example.net. IN NS ns.down.sub.example.net.
-; the DS record is not given (like it was parent and child hosted on the same
-; server)
-;down.sub.example.net.   3600    IN      DS      60946 5 1 c636304ab7cdb6272215aceac95a8d312ac7a4f6 
-;down.sub.example.net.	3600	IN	RRSIG	DS 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AMc8J534UF2+0PtPSNBw6RzN4Q5gXfnBXiUfpuT/MR1YtOE/5AP/0dTgvqvKRiFZx3NjOPeZmRnaabxkw0Qzrw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.down.sub.example.net. IN A 1.2.3.7
-ENTRY_END
-
-RANGE_END
-
-; ns.down.sub.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.7
-; DNSKEY query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-down.sub.example.net. IN DNSKEY
-SECTION ANSWER
-down.sub.example.net.	3600	IN	DNSKEY	257 3 5 AwEAAeiaUiUIpWMfYz5L0sfJTZWnuN9IyBX4em9VjsoqQTsOD1HDQpNb4buvJo7pN2aBCxNS7e0OL8e2mVB6CLZ+8ek= ;{id = 60946 (ksk), size = 512b}
-down.sub.example.net.	3600	IN	RRSIG	DNSKEY 5 4 3600 20070926134150 20070829134150 60946 down.sub.example.net. lK5HNva/IPw0CS9BfBd16fqm5y9bgCSwGsBLBAA1d5SCcKep6AVrv6NFuXl12d1G3MdQ4ruHi6eDDO5dhtkfrw== ;{id = 60946}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-; www.down.sub.example.net.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-www.down.sub.example.net. IN A
-SECTION ANSWER
-www.down.sub.example.net. IN A 10.20.30.44
-www.down.sub.example.net.	3600	IN	RRSIG	A 5 5 3600 20070926134150 20070829134150 60946 down.sub.example.net. Hg5WF/xW8PRth2rl1mZcYK8/pgGpM73e/fD+mH/XElEKgL9zq0ou8psA0I6OvMLGBN6RQeknQHRAy3D2/5k/Wg== ;{id = 60946}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.down.sub.example.net. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-www.down.sub.example.net. IN A
-SECTION ANSWER
-www.down.sub.example.net. IN A 10.20.30.44
-www.down.sub.example.net.	3600	IN	RRSIG	A 5 5 3600 20070926134150 20070829134150 60946 down.sub.example.net. Hg5WF/xW8PRth2rl1mZcYK8/pgGpM73e/fD+mH/XElEKgL9zq0ou8psA0I6OvMLGBN6RQeknQHRAy3D2/5k/Wg== ;{id = 60946}
-ENTRY_END
-
-SCENARIO_END
diff --git a/testdata/dlv_remove.rpl b/testdata/dlv_remove.rpl
deleted file mode 100644
index d503148c7..000000000
--- a/testdata/dlv_remove.rpl
+++ /dev/null
@@ -1,198 +0,0 @@
-; config options
-; The island of trust is at example.com (the DLV repository)
-server:
-	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	fake-sha1: yes
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator with DLV anchor but DLV domain is down
-; so DLV has been decommissioned.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-
-ENTRY_BEGIN
-MATCH opcode
-ADJUST copy_id copy_query
-REPLY QR SERVFAIL
-SECTION QUESTION
-example.com. IN NS
-ENTRY_END
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-; DS RR is
-; example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-; DNSKEY prime query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; www.example.net query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.net. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA DO SERVFAIL
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-ENTRY_END
-
-SCENARIO_END
diff --git a/testdata/dlv_remove_empty.rpl b/testdata/dlv_remove_empty.rpl
deleted file mode 100644
index 11b825bc2..000000000
--- a/testdata/dlv_remove_empty.rpl
+++ /dev/null
@@ -1,272 +0,0 @@
-; config options
-; The island of trust is at example.com (the DLV repository)
-server:
-	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	fake-sha1: yes
-	minimal-responses: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator with DLV and DLV repository is empty.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; DLV query, everything is NXDOMAIN
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR AA NXDOMAIN
-SECTION QUESTION
-example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com.	3600	IN	NSEC	example.com. NS SOA RRSIG NSEC DNSKEY 
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. AH++lP1qhsBw6zO1g3JVPZeQIpDhL9xT8V9xdgjXvCjIGQ1BUUlfQkA=
-SECTION ADDITIONAL
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-com.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-; DS RR is
-; example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-; DNSKEY prime query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; www.example.net query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.net. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA DO NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-SCENARIO_END
diff --git a/testdata/dlv_remove_nodel.rpl b/testdata/dlv_remove_nodel.rpl
deleted file mode 100644
index 1abe5a32f..000000000
--- a/testdata/dlv_remove_nodel.rpl
+++ /dev/null
@@ -1,276 +0,0 @@
-; config options
-; The island of trust is at example.com (the DLV repository)
-server:
-	dlv-anchor: "dlv.example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	fake-sha1: yes
-	minimal-responses: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator with DLV and DLV is removed and not delegated
-; so the response is that the dlv domain itself does not exist, but it's
-; parent domain does exist (securely).
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; DLV query, everything is NXDOMAIN
-; thus, no delegation to the dlv repository in dlv.example.com
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR AA NXDOMAIN
-SECTION QUESTION
-example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com.	3600	IN	NSEC	example.com. NS SOA RRSIG NSEC DNSKEY 
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. AH++lP1qhsBw6zO1g3JVPZeQIpDhL9xT8V9xdgjXvCjIGQ1BUUlfQkA=
-SECTION ADDITIONAL
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-com.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-; DS RR is
-; example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-; DNSKEY prime query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; www.example.net query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.net. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA DO NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-SCENARIO_END
diff --git a/testdata/dlv_remove_pos.rpl b/testdata/dlv_remove_pos.rpl
deleted file mode 100644
index 892ffa3c0..000000000
--- a/testdata/dlv_remove_pos.rpl
+++ /dev/null
@@ -1,167 +0,0 @@
-; config options
-; The island of trust is at example.com
-server:
-	dlv-anchor: "dlv.example.net.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-	minimal-responses: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator with DLV removed for positive anchored response
-; So the destination has a valid DNSSEC chain of trust to the root,
-; but the configured dlv anchor fails.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-; this covers dlv.example.net and thus makes it servfail (unusable).
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR SERVFAIL
-SECTION QUESTION
-net. IN NS
-ENTRY_END
-
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	10.20.30.40
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	10.20.30.40
-www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
-ENTRY_END
-
-SCENARIO_END
diff --git a/testdata/dlv_unused.rpl b/testdata/dlv_unused.rpl
deleted file mode 100644
index aa7d04c1e..000000000
--- a/testdata/dlv_unused.rpl
+++ /dev/null
@@ -1,277 +0,0 @@
-; config options
-; The island of trust is at example.com (the DLV repository)
-server:
-	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	trust-anchor: "example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-	minimal-responses: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator, DLV anchor unused because trustanchor works.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; DLV query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-example.net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-example.com IN NSEC zazz.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. AAi21jQpno6gXnrPrtK0NvNgX9B8E9U5RvTd47QiCWLF7KdtKxB7Xz0= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC zazz.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. AAi21jQpno6gXnrPrtK0NvNgX9B8E9U5RvTd47QiCWLF7KdtKxB7Xz0= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-com.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC zazz.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. AAi21jQpno6gXnrPrtK0NvNgX9B8E9U5RvTd47QiCWLF7KdtKxB7Xz0= ;{id = 2854}
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-; DS RR is
-; example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-; DNSKEY prime query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; www.example.net query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.net. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-SCENARIO_END
diff --git a/testdata/dnstap.tdir/unbound_control.key b/testdata/dnstap.tdir/unbound_control.key
index d7c43a06b..753a4ef61 100644
--- a/testdata/dnstap.tdir/unbound_control.key
+++ b/testdata/dnstap.tdir/unbound_control.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
-rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
-ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
-AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
-WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
-DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
-4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
-Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
-p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
-P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
-aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
-YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
-DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dnstap.tdir/unbound_control.pem b/testdata/dnstap.tdir/unbound_control.pem
index 8f1ba87f1..a1edf7017 100644
--- a/testdata/dnstap.tdir/unbound_control.pem
+++ b/testdata/dnstap.tdir/unbound_control.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
-AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
-6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
-qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
-J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
-9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
-iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
 -----END CERTIFICATE-----
diff --git a/testdata/dnstap.tdir/unbound_server.key b/testdata/dnstap.tdir/unbound_server.key
index 4256c421d..370a7bbb2 100644
--- a/testdata/dnstap.tdir/unbound_server.key
+++ b/testdata/dnstap.tdir/unbound_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dnstap.tdir/unbound_server.pem b/testdata/dnstap.tdir/unbound_server.pem
index aeda3ff11..986807310 100644
--- a/testdata/dnstap.tdir/unbound_server.pem
+++ b/testdata/dnstap.tdir/unbound_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
-y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
-/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
-g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
-9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
-l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
-Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/dnstap_reconnect.tdir/unbound_control.key b/testdata/dnstap_reconnect.tdir/unbound_control.key
index d7c43a06b..753a4ef61 100644
--- a/testdata/dnstap_reconnect.tdir/unbound_control.key
+++ b/testdata/dnstap_reconnect.tdir/unbound_control.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
-rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
-ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
-AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
-WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
-DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
-4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
-Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
-p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
-P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
-aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
-YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
-DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dnstap_reconnect.tdir/unbound_control.pem b/testdata/dnstap_reconnect.tdir/unbound_control.pem
index 8f1ba87f1..a1edf7017 100644
--- a/testdata/dnstap_reconnect.tdir/unbound_control.pem
+++ b/testdata/dnstap_reconnect.tdir/unbound_control.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
-AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
-6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
-qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
-J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
-9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
-iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
 -----END CERTIFICATE-----
diff --git a/testdata/dnstap_reconnect.tdir/unbound_server.key b/testdata/dnstap_reconnect.tdir/unbound_server.key
index 4256c421d..370a7bbb2 100644
--- a/testdata/dnstap_reconnect.tdir/unbound_server.key
+++ b/testdata/dnstap_reconnect.tdir/unbound_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dnstap_reconnect.tdir/unbound_server.pem b/testdata/dnstap_reconnect.tdir/unbound_server.pem
index aeda3ff11..986807310 100644
--- a/testdata/dnstap_reconnect.tdir/unbound_server.pem
+++ b/testdata/dnstap_reconnect.tdir/unbound_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
-y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
-/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
-g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
-9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
-l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
-Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/dnstap_tcp.tdir/unbound_control.key b/testdata/dnstap_tcp.tdir/unbound_control.key
index d7c43a06b..753a4ef61 100644
--- a/testdata/dnstap_tcp.tdir/unbound_control.key
+++ b/testdata/dnstap_tcp.tdir/unbound_control.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
-rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
-ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
-AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
-WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
-DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
-4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
-Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
-p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
-P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
-aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
-YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
-DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dnstap_tcp.tdir/unbound_control.pem b/testdata/dnstap_tcp.tdir/unbound_control.pem
index 8f1ba87f1..a1edf7017 100644
--- a/testdata/dnstap_tcp.tdir/unbound_control.pem
+++ b/testdata/dnstap_tcp.tdir/unbound_control.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
-AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
-6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
-qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
-J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
-9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
-iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
 -----END CERTIFICATE-----
diff --git a/testdata/dnstap_tcp.tdir/unbound_server.key b/testdata/dnstap_tcp.tdir/unbound_server.key
index 4256c421d..370a7bbb2 100644
--- a/testdata/dnstap_tcp.tdir/unbound_server.key
+++ b/testdata/dnstap_tcp.tdir/unbound_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dnstap_tcp.tdir/unbound_server.pem b/testdata/dnstap_tcp.tdir/unbound_server.pem
index aeda3ff11..986807310 100644
--- a/testdata/dnstap_tcp.tdir/unbound_server.pem
+++ b/testdata/dnstap_tcp.tdir/unbound_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
-y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
-/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
-g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
-9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
-l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
-Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/dnstap_tls.tdir/unbound_control.key b/testdata/dnstap_tls.tdir/unbound_control.key
index d7c43a06b..753a4ef61 100644
--- a/testdata/dnstap_tls.tdir/unbound_control.key
+++ b/testdata/dnstap_tls.tdir/unbound_control.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
-rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
-ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
-AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
-WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
-DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
-4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
-Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
-p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
-P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
-aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
-YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
-DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dnstap_tls.tdir/unbound_control.pem b/testdata/dnstap_tls.tdir/unbound_control.pem
index 8f1ba87f1..a1edf7017 100644
--- a/testdata/dnstap_tls.tdir/unbound_control.pem
+++ b/testdata/dnstap_tls.tdir/unbound_control.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
-AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
-6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
-qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
-J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
-9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
-iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
 -----END CERTIFICATE-----
diff --git a/testdata/dnstap_tls.tdir/unbound_server.key b/testdata/dnstap_tls.tdir/unbound_server.key
index 4256c421d..370a7bbb2 100644
--- a/testdata/dnstap_tls.tdir/unbound_server.key
+++ b/testdata/dnstap_tls.tdir/unbound_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dnstap_tls.tdir/unbound_server.pem b/testdata/dnstap_tls.tdir/unbound_server.pem
index aeda3ff11..986807310 100644
--- a/testdata/dnstap_tls.tdir/unbound_server.pem
+++ b/testdata/dnstap_tls.tdir/unbound_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
-y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
-/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
-g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
-9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
-l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
-Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/dnstap_tls_badcert.tdir/unbound_control.key b/testdata/dnstap_tls_badcert.tdir/unbound_control.key
index d7c43a06b..753a4ef61 100644
--- a/testdata/dnstap_tls_badcert.tdir/unbound_control.key
+++ b/testdata/dnstap_tls_badcert.tdir/unbound_control.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
-rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
-ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
-AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
-WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
-DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
-4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
-Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
-p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
-P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
-aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
-YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
-DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dnstap_tls_badcert.tdir/unbound_control.pem b/testdata/dnstap_tls_badcert.tdir/unbound_control.pem
index 8f1ba87f1..a1edf7017 100644
--- a/testdata/dnstap_tls_badcert.tdir/unbound_control.pem
+++ b/testdata/dnstap_tls_badcert.tdir/unbound_control.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
-AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
-6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
-qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
-J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
-9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
-iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
 -----END CERTIFICATE-----
diff --git a/testdata/dnstap_tls_badcert.tdir/unbound_server.key b/testdata/dnstap_tls_badcert.tdir/unbound_server.key
index 4256c421d..370a7bbb2 100644
--- a/testdata/dnstap_tls_badcert.tdir/unbound_server.key
+++ b/testdata/dnstap_tls_badcert.tdir/unbound_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dnstap_tls_badcert.tdir/unbound_server.pem b/testdata/dnstap_tls_badcert.tdir/unbound_server.pem
index aeda3ff11..986807310 100644
--- a/testdata/dnstap_tls_badcert.tdir/unbound_server.pem
+++ b/testdata/dnstap_tls_badcert.tdir/unbound_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
-y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
-/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
-g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
-9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
-l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
-Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/dnstap_tls_badname.tdir/unbound_control.key b/testdata/dnstap_tls_badname.tdir/unbound_control.key
index d7c43a06b..753a4ef61 100644
--- a/testdata/dnstap_tls_badname.tdir/unbound_control.key
+++ b/testdata/dnstap_tls_badname.tdir/unbound_control.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
-rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
-ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
-AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
-WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
-DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
-4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
-Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
-p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
-P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
-aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
-YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
-DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dnstap_tls_badname.tdir/unbound_control.pem b/testdata/dnstap_tls_badname.tdir/unbound_control.pem
index 8f1ba87f1..a1edf7017 100644
--- a/testdata/dnstap_tls_badname.tdir/unbound_control.pem
+++ b/testdata/dnstap_tls_badname.tdir/unbound_control.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
-AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
-6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
-qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
-J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
-9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
-iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
 -----END CERTIFICATE-----
diff --git a/testdata/dnstap_tls_badname.tdir/unbound_server.key b/testdata/dnstap_tls_badname.tdir/unbound_server.key
index 4256c421d..370a7bbb2 100644
--- a/testdata/dnstap_tls_badname.tdir/unbound_server.key
+++ b/testdata/dnstap_tls_badname.tdir/unbound_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dnstap_tls_badname.tdir/unbound_server.pem b/testdata/dnstap_tls_badname.tdir/unbound_server.pem
index aeda3ff11..986807310 100644
--- a/testdata/dnstap_tls_badname.tdir/unbound_server.pem
+++ b/testdata/dnstap_tls_badname.tdir/unbound_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
-y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
-/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
-g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
-9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
-l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
-Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/dnstap_tls_clientauth.tdir/unbound_control.key b/testdata/dnstap_tls_clientauth.tdir/unbound_control.key
index d7c43a06b..753a4ef61 100644
--- a/testdata/dnstap_tls_clientauth.tdir/unbound_control.key
+++ b/testdata/dnstap_tls_clientauth.tdir/unbound_control.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
-rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
-ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
-AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
-WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
-DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
-4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
-Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
-p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
-P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
-aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
-YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
-DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dnstap_tls_clientauth.tdir/unbound_control.pem b/testdata/dnstap_tls_clientauth.tdir/unbound_control.pem
index 8f1ba87f1..a1edf7017 100644
--- a/testdata/dnstap_tls_clientauth.tdir/unbound_control.pem
+++ b/testdata/dnstap_tls_clientauth.tdir/unbound_control.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
-AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
-6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
-qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
-J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
-9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
-iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
 -----END CERTIFICATE-----
diff --git a/testdata/dnstap_tls_clientauth.tdir/unbound_server.key b/testdata/dnstap_tls_clientauth.tdir/unbound_server.key
index 4256c421d..370a7bbb2 100644
--- a/testdata/dnstap_tls_clientauth.tdir/unbound_server.key
+++ b/testdata/dnstap_tls_clientauth.tdir/unbound_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dnstap_tls_clientauth.tdir/unbound_server.pem b/testdata/dnstap_tls_clientauth.tdir/unbound_server.pem
index aeda3ff11..986807310 100644
--- a/testdata/dnstap_tls_clientauth.tdir/unbound_server.pem
+++ b/testdata/dnstap_tls_clientauth.tdir/unbound_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
-y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
-/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
-g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
-9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
-l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
-Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/dnstap_tls_peername.tdir/unbound_control.key b/testdata/dnstap_tls_peername.tdir/unbound_control.key
index d7c43a06b..753a4ef61 100644
--- a/testdata/dnstap_tls_peername.tdir/unbound_control.key
+++ b/testdata/dnstap_tls_peername.tdir/unbound_control.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
-rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
-ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
-AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
-WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
-DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
-4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
-Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
-p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
-P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
-aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
-YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
-DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dnstap_tls_peername.tdir/unbound_control.pem b/testdata/dnstap_tls_peername.tdir/unbound_control.pem
index 8f1ba87f1..a1edf7017 100644
--- a/testdata/dnstap_tls_peername.tdir/unbound_control.pem
+++ b/testdata/dnstap_tls_peername.tdir/unbound_control.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
-AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
-6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
-qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
-J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
-9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
-iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
 -----END CERTIFICATE-----
diff --git a/testdata/dnstap_tls_peername.tdir/unbound_server.key b/testdata/dnstap_tls_peername.tdir/unbound_server.key
index 4256c421d..370a7bbb2 100644
--- a/testdata/dnstap_tls_peername.tdir/unbound_server.key
+++ b/testdata/dnstap_tls_peername.tdir/unbound_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dnstap_tls_peername.tdir/unbound_server.pem b/testdata/dnstap_tls_peername.tdir/unbound_server.pem
index aeda3ff11..986807310 100644
--- a/testdata/dnstap_tls_peername.tdir/unbound_server.pem
+++ b/testdata/dnstap_tls_peername.tdir/unbound_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
-y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
-/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
-g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
-9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
-l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
-Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/domain_insec_dlv.rpl b/testdata/domain_insec_dlv.rpl
deleted file mode 100644
index c8bd98344..000000000
--- a/testdata/domain_insec_dlv.rpl
+++ /dev/null
@@ -1,277 +0,0 @@
-; config options
-; The island of trust is at example.com (the DLV repository)
-server:
-	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	domain-insecure: "example.net"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	minimal-responses: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator with domain-insecure below a DLV
-; positive response for DLV.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; DLV query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net.example.com. IN DLV
-SECTION ANSWER
-example.net.example.com.	3600	IN	DLV	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-example.net.example.com.	3600	IN	RRSIG	DLV 3 4 3600 20070926134150 20070829134150 2854 example.com. ACK48Q/oKwh/SM9yRiKjZYuc+AtEZ2yCPNJ15kKCN8nsVcv7xigmNTY= ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-com.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-; DS RR is
-; example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-; DNSKEY prime query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; www.example.net query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.net. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA DO NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-SCENARIO_END
diff --git a/testdata/dynlibmod.tdir/unbound_control.key b/testdata/dynlibmod.tdir/unbound_control.key
index d7c43a06b..753a4ef61 100644
--- a/testdata/dynlibmod.tdir/unbound_control.key
+++ b/testdata/dynlibmod.tdir/unbound_control.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
-rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
-ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
-AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
-WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
-DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
-4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
-Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
-p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
-P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
-aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
-YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
-DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dynlibmod.tdir/unbound_control.pem b/testdata/dynlibmod.tdir/unbound_control.pem
index 8f1ba87f1..a1edf7017 100644
--- a/testdata/dynlibmod.tdir/unbound_control.pem
+++ b/testdata/dynlibmod.tdir/unbound_control.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
-AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
-6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
-qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
-J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
-9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
-iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
 -----END CERTIFICATE-----
diff --git a/testdata/dynlibmod.tdir/unbound_server.key b/testdata/dynlibmod.tdir/unbound_server.key
index 4256c421d..370a7bbb2 100644
--- a/testdata/dynlibmod.tdir/unbound_server.key
+++ b/testdata/dynlibmod.tdir/unbound_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/dynlibmod.tdir/unbound_server.pem b/testdata/dynlibmod.tdir/unbound_server.pem
index aeda3ff11..986807310 100644
--- a/testdata/dynlibmod.tdir/unbound_server.pem
+++ b/testdata/dynlibmod.tdir/unbound_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
-y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
-/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
-g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
-9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
-l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
-Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/edns_client_tag.rpl b/testdata/edns_client_tag.rpl
new file mode 100644
index 000000000..767652c26
--- /dev/null
+++ b/testdata/edns_client_tag.rpl
@@ -0,0 +1,151 @@
+; config options
+server:
+	edns-client-tag: 10.0.0.0/24 1234
+	edns-client-tag: 10.0.0.10/32 5678
+
+stub-zone:
+	name: "tag1234."
+	stub-addr: 10.0.0.1
+
+stub-zone:
+	name: "tag5678."
+	stub-addr: 10.0.0.10
+
+stub-zone:
+	name: "notag."
+	stub-addr: 10.10.0.1
+
+CONFIG_END
+
+SCENARIO_BEGIN Test EDNS client tag option
+
+RANGE_BEGIN 0 1000
+	ADDRESS 10.0.0.1
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+tag1234. IN A
+SECTION ANSWER
+tag1234. IN A 10.20.30.40
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+RANGE_BEGIN 0 1000
+	ADDRESS 10.0.0.10
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+tag5678. IN A
+SECTION ANSWER
+tag5678. IN A 10.20.30.40
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+RANGE_BEGIN 0 1000
+	ADDRESS 10.10.0.1
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+notag. IN A
+SECTION ANSWER
+notag. IN A 10.20.30.40
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+STEP 10 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+tag1234. IN A
+ENTRY_END
+
+STEP 20 CHECK_OUT_QUERY
+ENTRY_BEGIN
+MATCH qname qtype opcode ednsdata
+SECTION QUESTION
+tag1234. IN A
+SECTION ADDITIONAL
+	HEX_EDNSDATA_BEGIN
+		00 10           ; Opcode 16
+		00 02           ; Length 2
+		04 d2           ; 1234
+	HEX_EDNSDATA_END
+ENTRY_END
+
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+tag1234. IN A
+SECTION ANSWER
+tag1234. IN A 10.20.30.40
+ENTRY_END
+
+STEP 110 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+tag5678. IN A
+ENTRY_END
+
+STEP 120 CHECK_OUT_QUERY
+ENTRY_BEGIN
+MATCH qname qtype opcode ednsdata
+SECTION QUESTION
+tag5678. IN A
+SECTION ADDITIONAL
+	HEX_EDNSDATA_BEGIN
+		00 10           ; Opcode 16
+		00 02           ; Length 2
+		16 2e           ; 5678
+	HEX_EDNSDATA_END
+ENTRY_END
+
+STEP 130 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+tag5678. IN A
+SECTION ANSWER
+tag5678. IN A 10.20.30.40
+ENTRY_END
+
+STEP 210 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+notag. IN A
+ENTRY_END
+
+STEP 220 CHECK_OUT_QUERY
+ENTRY_BEGIN
+MATCH qname qtype opcode ednsdata
+SECTION QUESTION
+notag. IN A
+SECTION ADDITIONAL
+	HEX_EDNSDATA_BEGIN
+	HEX_EDNSDATA_END
+ENTRY_END
+
+STEP 230 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+notag. IN A
+SECTION ANSWER
+notag. IN A 10.20.30.40
+ENTRY_END
+
+SCENARIO_END
diff --git a/testdata/fwd_bogus.tdir/unbound_control.key b/testdata/fwd_bogus.tdir/unbound_control.key
index d7c43a06b..753a4ef61 100644
--- a/testdata/fwd_bogus.tdir/unbound_control.key
+++ b/testdata/fwd_bogus.tdir/unbound_control.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
-rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
-ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
-AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
-WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
-DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
-4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
-Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
-p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
-P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
-aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
-YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
-DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/fwd_bogus.tdir/unbound_control.pem b/testdata/fwd_bogus.tdir/unbound_control.pem
index 8f1ba87f1..a1edf7017 100644
--- a/testdata/fwd_bogus.tdir/unbound_control.pem
+++ b/testdata/fwd_bogus.tdir/unbound_control.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
-AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
-6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
-qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
-J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
-9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
-iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
 -----END CERTIFICATE-----
diff --git a/testdata/fwd_bogus.tdir/unbound_server.key b/testdata/fwd_bogus.tdir/unbound_server.key
index 4256c421d..370a7bbb2 100644
--- a/testdata/fwd_bogus.tdir/unbound_server.key
+++ b/testdata/fwd_bogus.tdir/unbound_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/fwd_bogus.tdir/unbound_server.pem b/testdata/fwd_bogus.tdir/unbound_server.pem
index aeda3ff11..986807310 100644
--- a/testdata/fwd_bogus.tdir/unbound_server.pem
+++ b/testdata/fwd_bogus.tdir/unbound_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
-y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
-/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
-g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
-9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
-l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
-Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/fwddlv_parse.rpl b/testdata/fwddlv_parse.rpl
deleted file mode 100644
index 8b8a9613f..000000000
--- a/testdata/fwddlv_parse.rpl
+++ /dev/null
@@ -1,134 +0,0 @@
-; config options
-; The island of trust is at example.com
-server:
-	trust-anchor: "dlv.isc.org. 5072    IN      DNSKEY  256 3 5 BEAAAAOlYGw53D+f01yCL5JsP0SB6EjYrnd0JYRBooAaGPT+Q0kpiN+7GviFh+nIazoB8e2Yv7mupgqkmIjObdcbGstYpUltdECdNpNmBvASKB9SBdtGeRvXXpORi3Qyxb9kHGG7SpzyYbc+KDVKnzYHB94pvqu3ZZpPFPBFtCibp/mkhw=="
-	val-override-date: "20090617133009"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test parse of packet when forwarding and dlv are in use
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-org. IN NS
-SECTION AUTHORITY
-org.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net. (for ORG)
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-org. IN NS
-SECTION ANSWER
-org.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-dlv.isc.org. IN NS
-SECTION AUTHORITY
-dlv.isc.org. IN NS ns.org.
-SECTION ADDITIONAL
-ns.org.	IN A 1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.org for dlv.isc.org
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-dlv.isc.org.	IN	DNSKEY
-SECTION ANSWER
-dlv.isc.org.	5072	IN	DNSKEY	256 3 5 BEAAAAOlYGw53D+f01yCL5JsP0SB6EjYrnd0JYRBooAaGPT+Q0kpiN+7GviFh+nIazoB8e2Yv7mupgqkmIjObdcbGstYpUltdECdNpNmBvASKB9SBdtGeRvXXpORi3Qyxb9kHGG7SpzyYbc+KDVKnzYHB94pvqu3ZZpPFPBFtCibp/mkhw== ;{id = 64263 (zsk), size = 1024b}
-dlv.isc.org.	5072	IN	DNSKEY	257 3 5 BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URkY62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboMQKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VStTDN0YUuWrBNh ;{id = 19297 (ksk), size = 2048b}
-dlv.isc.org.	5072	IN	RRSIG	DNSKEY 5 3 7200 20090717133009 20090617133009 19297 dlv.isc.org. iqGOzsIQKFHcPLbJHLb/kNzcm7TlHiyT4kzTknCjKsC7DCB86YCOhnZZjvZQyA+D0N0KDgNWY8v5czbyX57qR6qORciT2zmPSTGj7CIOe4zrq60n8HzsChKgvk+RSYQrzf6vRfnZhce6Y1waXQd4wh1buPAUw/l46Ovt74ALXzcWSgfMNyx6PBz7rbusuePKeSv0GZL9+M2qhXKe9LJmnzD9uCwnbV/Y5yu+xLfxLdm9q4IKp6Rn50CeHYKf3tO2jI9dkWqFR94XHSTNGfhC02i5UsfP1HRPnk49bX7OMstuuCq9zMX+qTt602MVFYdTSHTy/5+Yw5DvOA9JgOqO4w== ;{id = 19297}
-dlv.isc.org.	5072	IN	RRSIG	DNSKEY 5 3 7200 20090717133009 20090617133009 64263 dlv.isc.org. W1KX1PagXsaWWmxkaOfnLetnw1hhSw7ym91S4rSu14QfFbYi5iN9ZkSuKa21M7Do52S9om/2hDllMF7EFfnv9l4e4/rMOc59vKGVojpHOvZyRVhIiMyh1H9NfLTYUovORRvKO0Cnp65gBXspVf1WhzoY3pC1NZ+5pscPWLeD1rw= ;{id = 64263}
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-www.example.com.dlv.isc.org.	IN	DLV
-SECTION ANSWER
-SECTION AUTHORITY
-dlv.isc.org.	2776	IN	SOA	ns-int.isc.org. hostmaster.isc.org. 2009061702 7200 3600 2419200 3600
-dlv.isc.org.	2776	IN	RRSIG	SOA 5 3 3600 20090717133009 20090617133009 64263 dlv.isc.org. S5iTFqF8k9XWoGq4Wajo1GQF6Oc1e5lI1kGFWyaKf3oM2asbzCbVk2aZLtyDCGjYA4euZWXD0q2vol7/1cPB5Ds4SteCuo5Jkpa/mw7mPAcbNu8mYexq1RaodVCbWrW8KSxEyVd8X5mZx2OBaSyK8zns/W5I3ZPNNLf4Kz6Zpo0= ;{id = 64263}
-seatex.com.cn.dlv.isc.org.	2776	IN	RRSIG	NSEC 5 6 3600 20090717133009 20090617133009 64263 dlv.isc.org. Rxv7gVdu8rpWbJ3fJm7cY66IKV+C94I4/HYiDQke1m2P7hXo5bpDBBShKpIvME34ANN8Lb0cZQK9XT7NYpWjE5rjW7CaMiVjiR6U1LyDGQyK4X3wdkbv3aJcHLSg7sWsxyZXj5iVUxkU5JO3JBjo412oKQ3bh+RGi1BxTIIq09g= ;{id = 64263}
-seatex.com.cn.dlv.isc.org.	2776	IN	NSEC	absolight.com.dlv.isc.org. RRSIG NSEC DLV 
-ericgermann.com.dlv.isc.org.	2776	IN	RRSIG	NSEC 5 5 3600 20090717133009 20090617133009 64263 dlv.isc.org. OEUizWAXsWFBzt4rN5+AUTaND8phZc4ezux06LA/Ua5N/B/LQQ1cb42eEqCQHwnGK8BsRhbsRiVywPNgnnPlL1Gy8n25gi+0qWOpA27fOwZJbO3n944gKvPDWZoDeCbdJr6AQG5Z9/Ka0ERRtHC6uI2Xn6KCQPjgTEihqhoayYg= ;{id = 64263}
-ericgermann.com.dlv.isc.org.	2776	IN	NSEC	fayengineering.com.dlv.isc.org. RRSIG NSEC DLV 
-SECTION ADDITIONAL
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.com.dlv.isc.org. IN DLV
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD DO NXDOMAIN
-SECTION QUESTION
-www.example.com.dlv.isc.org. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-dlv.isc.org.    2776    IN      SOA     ns-int.isc.org. hostmaster.isc.org. 2009061702 7200 3600 2419200 3600
-dlv.isc.org.    2776    IN      RRSIG   SOA 5 3 3600 20090717133009 20090617133009 64263 dlv.isc.org. S5iTFqF8k9XWoGq4Wajo1GQF6Oc1e5lI1kGFWyaKf3oM2asbzCbVk2aZLtyDCGjYA4euZWXD0q2vol7/1cPB5Ds4SteCuo5Jkpa/mw7mPAcbNu8mYexq1RaodVCbWrW8KSxEyVd8X5mZx2OBaSyK8zns/W5I3ZPNNLf4Kz6Zpo0= ;{id = 64263}
-seatex.com.cn.dlv.isc.org.      2776    IN      NSEC    absolight.com.dlv.isc.org. RRSIG NSEC DLV
-seatex.com.cn.dlv.isc.org.      2776    IN      RRSIG   NSEC 5 6 3600 20090717133009 20090617133009 64263 dlv.isc.org. Rxv7gVdu8rpWbJ3fJm7cY66IKV+C94I4/HYiDQke1m2P7hXo5bpDBBShKpIvME34ANN8Lb0cZQK9XT7NYpWjE5rjW7CaMiVjiR6U1LyDGQyK4X3wdkbv3aJcHLSg7sWsxyZXj5iVUxkU5JO3JBjo412oKQ3bh+RGi1BxTIIq09g= ;{id = 64263}
-ericgermann.com.dlv.isc.org.    2776    IN      NSEC    fayengineering.com.dlv.isc.org. RRSIG NSEC DLV
-ericgermann.com.dlv.isc.org.    2776    IN      RRSIG   NSEC 5 5 3600 20090717133009 20090617133009 64263 dlv.isc.org. OEUizWAXsWFBzt4rN5+AUTaND8phZc4ezux06LA/Ua5N/B/LQQ1cb42eEqCQHwnGK8BsRhbsRiVywPNgnnPlL1Gy8n25gi+0qWOpA27fOwZJbO3n944gKvPDWZoDeCbdJr6AQG5Z9/Ka0ERRtHC6uI2Xn6KCQPjgTEihqhoayYg= ;{id = 64263}
-ENTRY_END
-
-SCENARIO_END
diff --git a/testdata/remote-threaded.tdir/unbound_control.key b/testdata/remote-threaded.tdir/unbound_control.key
index d7c43a06b..753a4ef61 100644
--- a/testdata/remote-threaded.tdir/unbound_control.key
+++ b/testdata/remote-threaded.tdir/unbound_control.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
-rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
-ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
-AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
-WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
-DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
-4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
-Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
-p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
-P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
-aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
-YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
-DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/remote-threaded.tdir/unbound_control.pem b/testdata/remote-threaded.tdir/unbound_control.pem
index 8f1ba87f1..a1edf7017 100644
--- a/testdata/remote-threaded.tdir/unbound_control.pem
+++ b/testdata/remote-threaded.tdir/unbound_control.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
-AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
-6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
-qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
-J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
-9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
-iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
 -----END CERTIFICATE-----
diff --git a/testdata/remote-threaded.tdir/unbound_server.key b/testdata/remote-threaded.tdir/unbound_server.key
index 4256c421d..370a7bbb2 100644
--- a/testdata/remote-threaded.tdir/unbound_server.key
+++ b/testdata/remote-threaded.tdir/unbound_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/remote-threaded.tdir/unbound_server.pem b/testdata/remote-threaded.tdir/unbound_server.pem
index aeda3ff11..986807310 100644
--- a/testdata/remote-threaded.tdir/unbound_server.pem
+++ b/testdata/remote-threaded.tdir/unbound_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
-y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
-/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
-g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
-9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
-l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
-Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/ssl_req_order.tdir/unbound_server.key b/testdata/ssl_req_order.tdir/unbound_server.key
index 4256c421d..370a7bbb2 100644
--- a/testdata/ssl_req_order.tdir/unbound_server.key
+++ b/testdata/ssl_req_order.tdir/unbound_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/ssl_req_order.tdir/unbound_server.pem b/testdata/ssl_req_order.tdir/unbound_server.pem
index aeda3ff11..986807310 100644
--- a/testdata/ssl_req_order.tdir/unbound_server.pem
+++ b/testdata/ssl_req_order.tdir/unbound_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
-y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
-/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
-g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
-9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
-l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
-Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/ssl_req_timeout.tdir/unbound_server.key b/testdata/ssl_req_timeout.tdir/unbound_server.key
index 4256c421d..370a7bbb2 100644
--- a/testdata/ssl_req_timeout.tdir/unbound_server.key
+++ b/testdata/ssl_req_timeout.tdir/unbound_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/ssl_req_timeout.tdir/unbound_server.pem b/testdata/ssl_req_timeout.tdir/unbound_server.pem
index aeda3ff11..986807310 100644
--- a/testdata/ssl_req_timeout.tdir/unbound_server.pem
+++ b/testdata/ssl_req_timeout.tdir/unbound_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
-y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
-/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
-g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
-9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
-l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
-Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/stat_values.tdir/stat_values.conf b/testdata/stat_values.tdir/stat_values.conf
new file mode 100644
index 000000000..5cec691f5
--- /dev/null
+++ b/testdata/stat_values.tdir/stat_values.conf
@@ -0,0 +1,31 @@
+server:
+	verbosity: 2
+	num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	extended-statistics: yes
+	identity: "stat_values"
+
+	local-zone: local.zone static
+	local-data: "www.local.zone A 192.0.2.1"
+remote-control:
+	control-enable: yes
+	control-interface: 127.0.0.1
+	# control-interface: ::1
+	control-port: @CONTROL_PORT@
+	server-key-file: "unbound_server.key"
+	server-cert-file: "unbound_server.pem"
+	control-key-file: "unbound_control.key"
+	control-cert-file: "unbound_control.pem"
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+forward-zone:
+	name: "expired."
+	forward-addr: "127.0.0.1@@EXPIREDPORT@"
diff --git a/testdata/stat_values.tdir/stat_values.dsc b/testdata/stat_values.tdir/stat_values.dsc
new file mode 100644
index 000000000..5112dbcf9
--- /dev/null
+++ b/testdata/stat_values.tdir/stat_values.dsc
@@ -0,0 +1,16 @@
+BaseName: stat_values
+Version: 1.0
+Description: Test unbound statistics
+CreationDate: Mon Sep 09 14:48:03 CEST 2020
+Maintainer:
+Category:
+Component:
+CmdDepends:
+Depends:
+Help:
+Pre: stat_values.pre
+Post: stat_values.post
+Test: stat_values.test
+AuxFiles:
+Passed:
+Failure:
diff --git a/testdata/stat_values.tdir/stat_values.post b/testdata/stat_values.tdir/stat_values.post
new file mode 100644
index 000000000..8656b599f
--- /dev/null
+++ b/testdata/stat_values.tdir/stat_values.post
@@ -0,0 +1,14 @@
+# #-- stat_values.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill $FWD_EXPIRED_PID >/dev/null 2>&1  # This is killed during testing.
+# it was stopped with unbound-control (if the test succeeded)
+kill $UNBOUND_PID >/dev/null 2>&1
+kill $UNBOUND_PID >/dev/null 2>&1
+exit 0
diff --git a/testdata/stat_values.tdir/stat_values.pre b/testdata/stat_values.tdir/stat_values.pre
new file mode 100644
index 000000000..2db4a17e0
--- /dev/null
+++ b/testdata/stat_values.tdir/stat_values.pre
@@ -0,0 +1,41 @@
+# #-- stat_values.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 4
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+FWD_EXPIRED_PORT=$(($RND_PORT + 2))
+CONTROL_PORT=$(($RND_PORT + 3))
+FWD_EXPIRED_PORT=$(($RND_PORT + 4))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+echo "FWD_EXPIRED_PORT=$FWD_EXPIRED_PORT" >> .tpkg.var.test
+echo "CONTROL_PORT=$CONTROL_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT stat_values.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# start expired forwarder
+$LDNS_TESTNS -p $FWD_EXPIRED_PORT stat_values.testexpiredns >fwd_expired.log 2>&1 &
+FWD_EXPIRED_PID=$!
+echo "FWD_EXPIRED_PID=$FWD_EXPIRED_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' -e 's/@EXPIREDPORT\@/'$FWD_EXPIRED_PORT'/' -e 's/@CONTROL_PORT\@/'$CONTROL_PORT'/' < stat_values.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_ldns_testns_up fwd_expired.log
+wait_unbound_up unbound.log
diff --git a/testdata/stat_values.tdir/stat_values.test b/testdata/stat_values.tdir/stat_values.test
new file mode 100644
index 000000000..1cd19fa2b
--- /dev/null
+++ b/testdata/stat_values.tdir/stat_values.test
@@ -0,0 +1,411 @@
+# #-- stat_values.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+# We need kill_pid for the serve-expired-client-timeout test
+. ../common.sh
+
+PRE="../.."
+
+# Individual thread stats.
+STATS_IGNORE_THREAD="\
+^thread"
+
+# Histogram stats.
+STATS_IGNORE_HISTOGRAM="\
+^histogram"
+
+# Time dependent stats.
+STATS_IGNORE_TIME_SPECIFIC="\
+^total.recursion.time.avg=
+^total.recursion.time.median=
+^time.now=
+^time.up=
+^time.elapsed="
+
+# Usage dependent stats.
+STATS_IGNORE_USAGE_SPECIFIC="\
+^total.requestlist.avg=
+^total.requestlist.max=
+^total.requestlist.overwritten=
+^total.requestlist.exceeded=
+^total.requestlist.current.all=
+^total.requestlist.current.user=
+^total.tcpusage=
+^mem\."
+
+# Stats to ignore by default.
+STATS_IGNORE_DEFAULT="\
+$STATS_IGNORE_THREAD
+$STATS_IGNORE_HISTOGRAM
+$STATS_IGNORE_TIME_SPECIFIC
+$STATS_IGNORE_USAGE_SPECIFIC"
+
+# Various files to be used while testing.
+STATS_FILE=stats.$$
+EXPECTED_STATS_FILE=expected_stats.$$
+IGNORE_REGEX_FILE=ignore_regex.$$
+FILTERED_STATS_FILE=filtered_stats.$$
+FOUND_STATS_FILE=found_stats.$$
+REST_STATS_FILE=rest_stats.$$
+
+DEBUG=0
+
+# Write stats to $STATS_FILE.
+# Call this when you want to get stats from unbound.
+get_stats () {
+	echo "> Getting stats"
+	echo "$PRE/unbound-control -c ub.conf stats"
+	$PRE/unbound-control -c ub.conf stats > $STATS_FILE
+	if test $? -ne 0; then
+		echo "wrong exit value after success"
+		exit 1
+	fi
+}
+
+# Set the expected stat values by writing to $EXPECTED_STATS_FILE.
+# sort is used for proper diff later.
+set_expected_stats () {
+	echo "$1" | sort > $EXPECTED_STATS_FILE
+}
+
+# Set the regex to ignore stats by writing to $IGNORE_REGEX_FILE.
+set_ignore_regex_stats () {
+	echo "$1" > $IGNORE_REGEX_FILE
+}
+
+# Filter the stats by removing any matched regex from $IGNORE_REGEX_FILE,
+# sorts and writes the left over stats to $FILTERED_STATS_FILE.
+filter_stats () {
+	grep -v -f $IGNORE_REGEX_FILE $STATS_FILE | sort > $FILTERED_STATS_FILE
+}
+
+# Check that the stats in $FILTERED_STATS_FILE include the expected stats in
+# $EXPECTED_STATS_FILE.
+check_expected_stats () {
+	echo "> Checking expected stats"
+	grep -F -x -f $EXPECTED_STATS_FILE $FILTERED_STATS_FILE > $FOUND_STATS_FILE
+	if test $DEBUG -ne 0; then
+		echo "Found:"
+		cat $FOUND_STATS_FILE
+	fi
+	if diff $EXPECTED_STATS_FILE $FOUND_STATS_FILE; then
+		echo "OK"
+	else
+		echo "! bad expected stats:"
+        cat $FILTERED_STATS_FILE
+		exit 1
+	fi
+}
+
+# Check that the rest (unspecified) stats are all 0 (no surprises).
+check_rest_stats () {
+	echo "> Checking rest stats"
+	grep -F -x -v -f $EXPECTED_STATS_FILE $FILTERED_STATS_FILE > $REST_STATS_FILE
+	if test $DEBUG -ne 0; then
+		echo "Rest:"
+		cat $REST_STATS_FILE
+	fi
+	if grep -v "=0$" $REST_STATS_FILE; then
+		echo "! bad rest stats"
+		exit 1
+	else
+		echo "OK"
+	fi
+}
+
+# Main function to check stats by:
+# - Getting stats from unbound
+# - Filtering out the stats we are not interested in
+# - Checking that the expected stats are part of the filtered stats
+# - The rest of the stats have 0 values.
+check_stats () {
+	set_expected_stats "$1"
+	if test $DEBUG -ne 0; then
+		echo "Expected:"
+		cat $EXPECTED_STATS_FILE
+	fi
+	get_stats
+	filter_stats
+	if test $DEBUG -ne 0; then
+		echo "Filtered:"
+		cat $FILTERED_STATS_FILE
+	fi
+	check_expected_stats
+	check_rest_stats
+}
+
+# Convenient function to set an option through unbound-control.
+set_ub_option () {
+	name=$1
+	value=$2
+	echo "$PRE/unbound-control -c ub.conf set_option $name: $value"
+	$PRE/unbound-control -c ub.conf set_option $name: $value
+	if test $? -ne 0; then
+		echo "wrong exit value after success"
+		exit 1
+	fi
+}
+
+# Convenient function to exit the test.
+end () {
+	echo "> cat logfiles"
+	cat fwd.log
+	cat unbound.log
+	if test $1 -eq 1; then
+		echo "Not OK"
+	else
+		echo "> OK"
+	fi
+	exit $1
+}
+
+# Ignore all run specific stats.
+set_ignore_regex_stats "$STATS_IGNORE_DEFAULT"
+
+# Check if the server is up.
+echo "> dig 1ttl.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT 1ttl.example.com. | tee outfile
+echo "> check answer"
+if grep "1.1.1.1" outfile; then
+	echo "OK"
+else
+	end 1
+fi
+
+echo
+echo "[ Check initial stats based on first query. ]"
+check_stats "\
+total.num.queries=1
+total.num.cachemiss=1
+total.num.recursivereplies=1
+num.query.type.A=1
+num.query.class.IN=1
+num.query.opcode.QUERY=1
+num.query.flags.RD=1
+num.query.flags.AD=1
+num.query.edns.present=1
+msg.cache.count=1
+rrset.cache.count=1
+infra.cache.count=1
+num.answer.rcode.NOERROR=1"
+
+echo
+echo "[ Check stat reset. ]"
+check_stats "\
+msg.cache.count=1
+rrset.cache.count=1
+infra.cache.count=1"
+
+
+echo
+echo "[ Enable serve-expired and check. ]"
+set_ub_option serve-expired yes
+sleep 2  # make sure the TTL has expired.
+echo "> dig 1ttl.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT 1ttl.example.com. | tee outfile
+echo "> check answer"
+if grep "1.1.1.1" outfile; then
+	echo "OK"
+else
+	end 1
+fi
+check_stats "\
+total.num.queries=1
+total.num.expired=1
+total.num.cachehits=1
+total.num.prefetch=1
+num.answer.rcode.NOERROR=1
+num.query.class.IN=1
+num.query.edns.present=1
+num.query.flags.AD=1
+num.query.flags.RD=1
+num.query.opcode.QUERY=1
+num.query.type.A=1
+msg.cache.count=1
+rrset.cache.count=1
+infra.cache.count=1"
+
+
+echo
+echo "[ Enable serve-expired-client-timeout and check. ]"
+set_ub_option serve-expired-client-timeout 1
+echo "> dig servfail.expired."
+dig @127.0.0.1 -p $UNBOUND_PORT servfail.expired. | tee outfile
+echo "> check answer"
+if grep "192.0.2.1" outfile; then
+	echo "OK"
+else
+	end 1
+fi
+check_stats "\
+total.num.queries=1
+total.num.cachemiss=1
+total.num.recursivereplies=1
+num.query.type.A=1
+num.query.class.IN=1
+num.query.opcode.QUERY=1
+num.query.flags.RD=1
+num.query.flags.AD=1
+num.query.edns.present=1
+msg.cache.count=2
+rrset.cache.count=2
+infra.cache.count=2
+num.answer.rcode.NOERROR=1"
+kill_pid $FWD_EXPIRED_PID  # kill the expired forwarder to force a servfail from upstream.
+sleep 2  # make sure the TTL has expired.
+echo "> dig servfail.expired."
+dig @127.0.0.1 -p $UNBOUND_PORT servfail.expired. | tee outfile
+echo "> check answer"
+if grep "192.0.2.1" outfile; then
+	echo "OK"
+else
+	end 1
+fi
+check_stats "\
+total.num.queries=1
+total.num.expired=1
+total.num.recursivereplies=1
+num.answer.rcode.NOERROR=1
+num.query.class.IN=1
+num.query.edns.present=1
+num.query.flags.AD=1
+num.query.flags.RD=1
+num.query.opcode.QUERY=1
+num.query.type.A=1
+total.num.cachemiss=1
+msg.cache.count=2
+rrset.cache.count=2
+infra.cache.count=2"
+
+
+# Disable serve-expired
+set_ub_option serve-expired no
+
+
+echo
+echo "[ Check REFUSED; try without RD flag. ]"
+echo "> dig somethingelse.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT +nordflag somethingelse.example.com. | tee outfile
+echo "> check answer"
+if grep "REFUSED" outfile; then
+	echo "OK"
+else
+	end 1
+fi
+check_stats "\
+num.answer.rcode.REFUSED=1
+total.num.cachehits=1
+num.query.class.IN=1
+num.query.edns.present=1
+num.query.flags.AD=1
+num.query.opcode.QUERY=1
+num.query.type.A=1
+total.num.queries=1
+msg.cache.count=2
+rrset.cache.count=2
+infra.cache.count=2"
+
+
+echo
+echo "[ Check the AD flag. ]"
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT +noadflag www.example.com. | tee outfile
+echo "> check answer"
+if grep "10.20.30.40" outfile; then
+	echo "OK"
+else
+	end 1
+fi
+check_stats "\
+num.query.flags.AD=0
+total.num.cachemiss=1
+num.answer.rcode.NOERROR=1
+num.query.class.IN=1
+num.query.edns.present=1
+num.query.flags.RD=1
+num.query.opcode.QUERY=1
+num.query.type.A=1
+total.num.queries=1
+total.num.recursivereplies=1
+msg.cache.count=3
+rrset.cache.count=3
+infra.cache.count=2"
+
+echo
+echo "[ Check local zone. ]"
+echo "> dig www.local.zone."
+dig @127.0.0.1 -p $UNBOUND_PORT www.local.zone. | tee outfile
+echo "> check answer"
+if grep "192.0.2.1" outfile; then
+	echo "OK"
+else
+	end 1
+fi
+check_stats "\
+num.answer.rcode.NOERROR=1
+total.num.cachehits=1
+num.query.class.IN=1
+num.query.edns.present=1
+num.query.flags.AD=1
+num.query.flags.RD=1
+num.query.opcode.QUERY=1
+num.query.type.A=1
+total.num.queries=1
+msg.cache.count=3
+rrset.cache.count=3
+infra.cache.count=2"
+
+
+echo
+echo "[ Check NXDOMAIN (with local data). ]"
+echo "> dig mail.local.zone."
+dig @127.0.0.1 -p $UNBOUND_PORT mail.local.zone. | tee outfile
+echo "> check answer"
+if grep "NXDOMAIN" outfile; then
+	echo "OK"
+else
+	end 1
+fi
+check_stats "\
+num.answer.rcode.NXDOMAIN=1
+total.num.cachehits=1
+num.query.class.IN=1
+num.query.edns.present=1
+num.query.flags.AD=1
+num.query.flags.RD=1
+num.query.opcode.QUERY=1
+num.query.type.A=1
+total.num.queries=1
+msg.cache.count=3
+rrset.cache.count=3
+infra.cache.count=2"
+
+
+echo
+echo "[ Check CHAOS. ]"
+echo "> dig id.server. ch txt"
+dig @127.0.0.1 -p $UNBOUND_PORT id.server. ch txt | tee outfile
+echo "> check answer"
+if grep "stat_values" outfile; then
+	echo "OK"
+else
+	end 1
+fi
+check_stats "\
+num.query.class.CH=1
+total.num.cachehits=1
+num.answer.rcode.NOERROR=1
+num.query.edns.present=1
+num.query.flags.AD=1
+num.query.flags.RD=1
+num.query.opcode.QUERY=1
+num.query.type.TXT=1
+total.num.queries=1
+msg.cache.count=3
+rrset.cache.count=3
+infra.cache.count=2"
+
+
+end 0
diff --git a/testdata/stat_values.tdir/stat_values.testexpiredns b/testdata/stat_values.tdir/stat_values.testexpiredns
new file mode 100644
index 000000000..a737a4a79
--- /dev/null
+++ b/testdata/stat_values.tdir/stat_values.testexpiredns
@@ -0,0 +1,13 @@
+; nameserver test file
+$ORIGIN expired.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+servfail	IN	A
+SECTION ANSWER
+servfail    1 IN A 192.0.2.1
+ENTRY_END
diff --git a/testdata/stat_values.tdir/stat_values.testns b/testdata/stat_values.tdir/stat_values.testns
new file mode 100644
index 000000000..6691b0199
--- /dev/null
+++ b/testdata/stat_values.tdir/stat_values.testns
@@ -0,0 +1,23 @@
+; nameserver test file
+$ORIGIN example.com.
+$TTL 3600
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	IN	A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+1ttl	IN	A
+SECTION ANSWER
+1ttl	1 IN	A 1.1.1.1
+ENTRY_END
diff --git a/testdata/stat_values.tdir/unbound_control.key b/testdata/stat_values.tdir/unbound_control.key
new file mode 100644
index 000000000..753a4ef61
--- /dev/null
+++ b/testdata/stat_values.tdir/unbound_control.key
@@ -0,0 +1,39 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/stat_values.tdir/unbound_control.pem b/testdata/stat_values.tdir/unbound_control.pem
new file mode 100644
index 000000000..a1edf7017
--- /dev/null
+++ b/testdata/stat_values.tdir/unbound_control.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
+-----END CERTIFICATE-----
diff --git a/testdata/stat_values.tdir/unbound_server.key b/testdata/stat_values.tdir/unbound_server.key
new file mode 100644
index 000000000..370a7bbb2
--- /dev/null
+++ b/testdata/stat_values.tdir/unbound_server.key
@@ -0,0 +1,39 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/stat_values.tdir/unbound_server.pem b/testdata/stat_values.tdir/unbound_server.pem
new file mode 100644
index 000000000..986807310
--- /dev/null
+++ b/testdata/stat_values.tdir/unbound_server.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
+-----END CERTIFICATE-----
diff --git a/testdata/stream_ssl.tdir/unbound_control.key b/testdata/stream_ssl.tdir/unbound_control.key
index d7c43a06b..753a4ef61 100644
--- a/testdata/stream_ssl.tdir/unbound_control.key
+++ b/testdata/stream_ssl.tdir/unbound_control.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDD6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBa
-rzPA0vlyuNtUsEN3qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvH
-ST6JwUdIg0Lzg/USJ81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQAB
-AoGAFT3e35MIgI4uDJJ8X0RfHp2NCO2LUg4TKbWical/C0W9vlR1/x80G1pE1d2Z
-WotqJVWTrOq6eBox19RCgtLg2wPGk9uD62+9SDT37heWFlUCElWq50pQG6k9ThiG
-DDypkZyZ/52+DdWybiaQJkuK6O5qQXuNAtVJMpghu4GnHAECQQDsupnZUQDpapzr
-4FC4MSkL2+A1PRt6g4VhwoqOpJXaHfVnH6F7AwUuOLNwGdR5Cvv70pfJ7Jqg8L2m
-Kxyl5bORAkEA09rn34YQ0pHJdHidbl2kInIuYTz09+TO3LWwan17nISH9aaYvVDr
-p9x1B4Qzw9qyxT9oll7ze/5Rw/7C3AQj4QJAT2B2a+b8bkgAXBs4FbruL3rHoDJg
-P2FQXSpVOWU4lg2LlsuFYvDtUMVUbZdLplanjZXcral3Y9W1Ub2M+ped8QJAYQN+
-aRpge7ys7vwIw7B36Bo3aOncF+ScYe+FkM5Tm7II/JHEofT7ZQwMP1vnxIlSkgbe
-YvWqNB6a3NC99LikoQJBAM4UhDdRg63Tr6Idky6CQaH///zAN7nArJfffKGWFdw9
-DKrWpNqvYZtX/cfEJucKcRCm5YL8CKFYbQy4VoCxUcE=
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/stream_ssl.tdir/unbound_control.pem b/testdata/stream_ssl.tdir/unbound_control.pem
index 8f1ba87f1..a1edf7017 100644
--- a/testdata/stream_ssl.tdir/unbound_control.pem
+++ b/testdata/stream_ssl.tdir/unbound_control.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBozCCAQwCCQD6XaN6FzW/4DANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowGjEYMBYGA1UE
-AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD
-6DogNCsSeEa1u99+6PUVbGzjMzzei9MIK6s94+zcpp7OAOBarzPA0vlyuNtUsEN3
-qwPomQQQmIgbT7OXkzC1wqioxwa609xoL8oW/I7e336rEyvHST6JwUdIg0Lzg/US
-J81eTwMnzYSd4Bpsqr9eP33ubaR7Gh/6o76loLOlcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBAGFAXmaQHuFgAuc6HVhYZJdToxLBhfxGpot4oZNjcb1Cdoz3OL34MU1B
-9E5psj2PpGPIi8/RwoqBtAJHJ+J5cWngo03o4ZmdwKNSzaxlp141z/3rUtFqEHEC
-iO6gPCT3U7dt6MyC7r6vdMqyW6aldP3CtwD0gQziKAMoj+TAfAcq
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
 -----END CERTIFICATE-----
diff --git a/testdata/stream_ssl.tdir/unbound_server.key b/testdata/stream_ssl.tdir/unbound_server.key
index 4256c421d..370a7bbb2 100644
--- a/testdata/stream_ssl.tdir/unbound_server.key
+++ b/testdata/stream_ssl.tdir/unbound_server.key
@@ -1,15 +1,39 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
 -----END RSA PRIVATE KEY-----
diff --git a/testdata/stream_ssl.tdir/unbound_server.pem b/testdata/stream_ssl.tdir/unbound_server.pem
index aeda3ff11..986807310 100644
--- a/testdata/stream_ssl.tdir/unbound_server.pem
+++ b/testdata/stream_ssl.tdir/unbound_server.pem
@@ -1,11 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQDsNJ1UmphEFzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkxMTA5MDk0MFoXDTI4MDUyOTA5MDk0MFowEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtxeybL9rtNaS
-y/axZ47DFPyGghVCM/+tuA3GhPOGeIIzJeZFgN2sUHKrpdcJcEq2ysK6J8vnfYR/
-/jF9LWcL5fMNzpoZjgImkPkhwrCLjo1cEI19LESwetT8+fjwIlb5z2vSSGAeUKyu
-g1RLMSB4/DDnOSSjka5xErBQ4esnjHkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAZ
-9N0lnLENs4JMvPS+mn8C5m9bkkFITd32IiLjf0zgYpIUbFXH6XaEr9GNZBUG8feG
-l/6WRXnbnVSblI5odQ4XxGZ9inYY6qtW30uv76HvoKp+QZ1c3460ddR8NauhcCHH
-Z7S+QbLXi+r2JAhpPozZCjBHlRD0ixzA1mKQTJhJZg==
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
 -----END CERTIFICATE-----
diff --git a/testdata/val_stub_noroot.rpl b/testdata/val_stub_noroot.rpl
index 4235bcc52..07113bef7 100644
--- a/testdata/val_stub_noroot.rpl
+++ b/testdata/val_stub_noroot.rpl
@@ -3,8 +3,6 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	trust-anchor: "lp0.eu. IN DNSKEY 257 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3"
 	val-override-date: "20100913111500"
-	; the dlv anchor is completely ignored, but here to test that.
-	dlv-anchor: "dlv.isc.org. IN DNSKEY 257 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3"
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
diff --git a/testdata/val_unalgo_dlv.rpl b/testdata/val_unalgo_dlv.rpl
deleted file mode 100644
index 142beae8d..000000000
--- a/testdata/val_unalgo_dlv.rpl
+++ /dev/null
@@ -1,284 +0,0 @@
-; config options
-; The island of trust is at example.com (the DLV repository)
-server:
-	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-	minimal-responses: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator with unknown algorithm DLV anchor
-; positive response for DLV.
-; but only has unknown algos
-; have to treat zone as insecure
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; DLV query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net.example.com. IN DLV
-SECTION ANSWER
-; algo 208 is unknown
-example.net.example.com.	3600	IN	DLV	30899 208 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-example.net.example.com.	3600	IN	RRSIG	DLV 3 4 3600 20070926134150 20070829134150 2854 example.com. AFBU1dN/KstcLfQQzy7ZKvPq+2hQg7D6QynqgwI3f8envPQGj782/NA= ;{id = 2854}
-;example.net.example.com.	3600	IN	DLV	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-;example.net.example.com.	3600	IN	RRSIG	DLV 3 4 3600 20070926134150 20070829134150 2854 example.com. ACK48Q/oKwh/SM9yRiKjZYuc+AtEZ2yCPNJ15kKCN8nsVcv7xigmNTY= ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-com.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC example.net.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AIoUkJ04/7/kJFDLocoqksqt9UL2RHHwlRfXAMxGdBHcNO+GSpG47Uk= ;{id = 2854}
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-; DS RR is
-; example.net.	3600	IN	DS	30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
-; DNSKEY prime query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; www.example.net query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.net. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA DO NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	3600	IN	A	10.20.30.40
-www.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926135752 20070829135752 30899 example.net. ACvv4RQVC7TbI57ewqFImRaVoymktJ5Cxn/FaCodIENt82LVM92nivbP2WtwWCsQHWp7FkrMxTlQTJwyAeXFyg== ;{id = 30899}
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-SCENARIO_END
diff --git a/util/config_file.c b/util/config_file.c
index 85b43e717..209a8d752 100644
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -241,8 +241,6 @@ config_create(void)
 	cfg->trusted_keys_file_list = NULL;
 	cfg->trust_anchor_signaling = 1;
 	cfg->root_key_sentinel = 1;
-	cfg->dlv_anchor_file = NULL;
-	cfg->dlv_anchor_list = NULL;
 	cfg->domain_insecure = NULL;
 	cfg->val_date_override = 0;
 	cfg->val_sig_skew_min = 3600; /* at least daylight savings trouble */
@@ -306,6 +304,7 @@ config_create(void)
 	if(!(cfg->dnstap_socket_path = strdup(DNSTAP_SOCKET_PATH)))
 		goto error_exit;
 #endif
+	cfg->dnstap_bidirectional = 1;
 	cfg->dnstap_tls = 1;
 	cfg->disable_dnssec_lame_check = 0;
 	cfg->ip_ratelimit = 0;
@@ -322,6 +321,7 @@ config_create(void)
 	cfg->qname_minimisation_strict = 0;
 	cfg->shm_enable = 0;
 	cfg->shm_key = 11777;
+	cfg->edns_client_tags = NULL;
 	cfg->dnscrypt = 0;
 	cfg->dnscrypt_port = 0;
 	cfg->dnscrypt_provider = NULL;
@@ -594,8 +594,6 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_STRLIST("trusted-keys-file:", trusted_keys_file_list)
 	else S_YNO("trust-anchor-signaling:", trust_anchor_signaling)
 	else S_YNO("root-key-sentinel:", root_key_sentinel)
-	else S_STR("dlv-anchor-file:", dlv_anchor_file)
-	else S_STRLIST("dlv-anchor:", dlv_anchor_list)
 	else S_STRLIST("domain-insecure:", domain_insecure)
 	else S_NUMBER_OR_ZERO("val-bogus-ttl:", bogus_ttl)
 	else S_YNO("val-clean-additional:", val_clean_additional)
@@ -653,6 +651,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 #endif
 #ifdef USE_DNSTAP
 	else S_YNO("dnstap-enable:", dnstap)
+	else S_YNO("dnstap-bidirectional:", dnstap_bidirectional)
 	else S_STR("dnstap-socket-path:", dnstap_socket_path)
 	else S_STR("dnstap-ip:", dnstap_ip)
 	else S_YNO("dnstap-tls:", dnstap_tls)
@@ -1016,7 +1015,6 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_DEC(opt, "unwanted-reply-threshold", unwanted_threshold)
 	else O_YNO(opt, "do-not-query-localhost", donotquery_localhost)
 	else O_STR(opt, "module-config", module_conf)
-	else O_STR(opt, "dlv-anchor-file", dlv_anchor_file)
 	else O_DEC(opt, "val-bogus-ttl", bogus_ttl)
 	else O_YNO(opt, "val-clean-additional", val_clean_additional)
 	else O_DEC(opt, "val-log-level", val_log_level)
@@ -1054,7 +1052,6 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_LST(opt, "trusted-keys-file", trusted_keys_file_list)
 	else O_YNO(opt, "trust-anchor-signaling", trust_anchor_signaling)
 	else O_YNO(opt, "root-key-sentinel", root_key_sentinel)
-	else O_LST(opt, "dlv-anchor", dlv_anchor_list)
 	else O_LST(opt, "control-interface", control_ifs.first)
 	else O_LST(opt, "domain-insecure", domain_insecure)
 	else O_UNS(opt, "val-override-date", val_date_override)
@@ -1075,6 +1072,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 #endif
 #ifdef USE_DNSTAP
 	else O_YNO(opt, "dnstap-enable", dnstap)
+	else O_YNO(opt, "dnstap-bidirectional", dnstap_bidirectional)
 	else O_STR(opt, "dnstap-socket-path", dnstap_socket_path)
 	else O_STR(opt, "dnstap-ip", dnstap_ip)
 	else O_YNO(opt, "dnstap-tls", dnstap_tls)
@@ -1147,6 +1145,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_LS3(opt, "access-control-tag-action", acl_tag_actions)
 	else O_LS3(opt, "access-control-tag-data", acl_tag_datas)
 	else O_LS2(opt, "access-control-view", acl_view)
+	else O_LS2(opt, "edns_client_tags", edns_client_tags)
 #ifdef USE_IPSECMOD
 	else O_YNO(opt, "ipsecmod-enabled", ipsecmod_enabled)
 	else O_YNO(opt, "ipsecmod-ignore-bogus", ipsecmod_ignore_bogus)
@@ -1408,8 +1407,8 @@ config_delviews(struct config_view* p)
 		p = np;
 	}
 }
-/** delete string array */
-static void
+
+void
 config_del_strarray(char** array, int num)
 {
 	int i;
@@ -1480,8 +1479,6 @@ config_delete(struct config_file* cfg)
 	config_delstrlist(cfg->trusted_keys_file_list);
 	config_delstrlist(cfg->trust_anchor_list);
 	config_delstrlist(cfg->domain_insecure);
-	free(cfg->dlv_anchor_file);
-	config_delstrlist(cfg->dlv_anchor_list);
 	config_deldblstrlist(cfg->acls);
 	config_deldblstrlist(cfg->tcp_connection_limits);
 	free(cfg->val_nsec3_key_iterations);
@@ -1517,6 +1514,7 @@ config_delete(struct config_file* cfg)
 	config_deldblstrlist(cfg->ratelimit_below_domain);
 	config_delstrlist(cfg->python_script);
 	config_delstrlist(cfg->dynlib_file);
+	config_deldblstrlist(cfg->edns_client_tags);
 #ifdef USE_IPSECMOD
 	free(cfg->ipsecmod_hook);
 	config_delstrlist(cfg->ipsecmod_whitelist);
diff --git a/util/config_file.h b/util/config_file.h
index 4c568b121..3148dd016 100644
--- a/util/config_file.h
+++ b/util/config_file.h
@@ -344,10 +344,6 @@ struct config_file {
 	struct config_strlist* auto_trust_anchor_file_list;
 	/** files with trusted DNSKEYs in named.conf format, list */
 	struct config_strlist* trusted_keys_file_list;
-	/** DLV anchor file */
-	char* dlv_anchor_file;
-	/** DLV anchor inline */
-	struct config_strlist* dlv_anchor_list;
 	/** insecure domain list */
 	struct config_strlist* domain_insecure;
 	/** send key tag query */
@@ -494,6 +490,8 @@ struct config_file {
 
 	/** true to enable dnstap support */
 	int dnstap;
+	/** using bidirectional frame streams if true */
+	int dnstap_bidirectional;
 	/** dnstap socket path */
 	char* dnstap_socket_path;
 	/** dnstap IP */
@@ -564,6 +562,9 @@ struct config_file {
 	/** SHM data - key for the shm */
 	int shm_key;
 
+	/** list of EDNS client tag entries, linked list */
+	struct config_str2list* edns_client_tags;
+
 	/** DNSCrypt */
 	/** true to enable dnscrypt */
 	int dnscrypt;
@@ -985,6 +986,9 @@ void config_deldblstrlist(struct config_str2list* list);
  */
 void config_deltrplstrlist(struct config_str3list* list);
 
+/** delete string array */
+void config_del_strarray(char** array, int num);
+
 /** delete stringbytelist */
 void config_del_strbytelist(struct config_strbytelist* list);
 
diff --git a/util/configlexer.c b/util/configlexer.c
index 1e684158b..16158e472 100644
--- a/util/configlexer.c
+++ b/util/configlexer.c
@@ -354,8 +354,8 @@ static void yynoreturn yy_fatal_error ( const char* msg  );
 	(yy_hold_char) = *yy_cp; \
 	*yy_cp = '\0'; \
 	(yy_c_buf_p) = yy_cp;
-#define YY_NUM_RULES 320
-#define YY_END_OF_BUFFER 321
+#define YY_NUM_RULES 330
+#define YY_END_OF_BUFFER 331
 /* This struct is not used in this scanner,
    but its presence is necessary. */
 struct yy_trans_info
@@ -363,356 +363,363 @@ struct yy_trans_info
 	flex_int32_t yy_verify;
 	flex_int32_t yy_nxt;
 	};
-static const flex_int16_t yy_accept[3162] =
+static const flex_int16_t yy_accept[3227] =
     {   0,
-        1,    1,  302,  302,  306,  306,  310,  310,  314,  314,
-        1,    1,  321,  318,    1,  300,  300,  319,    2,  319,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  302,  303,  303,  304,  319,  306,  307,  307,
-      308,  319,  313,  310,  311,  311,  312,  319,  314,  315,
-      315,  316,  319,  317,  301,    2,  305,  319,  317,  318,
-        0,    1,    2,    2,    2,    2,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+        1,    1,  304,  304,  308,  308,  312,  312,  316,  316,
+        1,    1,  320,  320,  324,  324,  331,  328,    1,  302,
+      302,  329,    2,  329,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  304,  305,  305,  306,
+      329,  308,  309,  309,  310,  329,  315,  312,  313,  313,
+      314,  329,  316,  317,  317,  318,  329,  327,  303,    2,
+      307,  329,  327,  323,  320,  321,  321,  322,  329,  324,
+      325,  325,  326,  329,  328,    0,    1,    2,    2,    2,
+        2,  328,  328,  328,  328,  328,  328,  328,  328,  328,
 
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  302,    0,  306,    0,  313,    0,  310,  314,
-        0,  317,    0,    2,    2,  317,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  304,    0,  308,
+        0,  315,    0,  312,  316,    0,  327,    0,    2,    2,
+      327,  323,    0,  320,  324,    0,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
 
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  317,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  327,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
 
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  121,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  129,  318,  318,  318,  318,  318,  318,  318,
-      317,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  121,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  129,  328,  328,  328,  328,  328,  328,  328,
+      327,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
 
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  105,
-      318,  318,  318,  318,  318,  318,    8,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  122,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  105,
+      328,  328,  328,  328,  328,  328,    8,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  122,  328,  328,  328,  328,
 
-      318,  318,  318,  318,  318,  134,  318,  317,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  295,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  134,  328,  327,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  296,  328,  328,  328,  328,  328,
 
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  317,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,   63,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  327,  328,  328,  328,  328,
 
-      318,  233,  318,   14,   15,  318,   19,   18,  318,  318,
-      217,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      128,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  215,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  328,  328,  328,  328,  328,  328,   63,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  233,  328,   14,   15,  328,   19,   18,  328,
+      328,  217,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  128,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
 
-        3,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  317,  318,  318,  318,  318,  318,
-      318,  318,  289,  318,  318,  288,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  328,  328,  215,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,    3,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  327,  328,  328,  328,
+      328,  328,  328,  328,  290,  328,  328,  289,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
 
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  309,  318,
-      318,  318,  318,  318,  318,  318,   62,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,   66,  318,  263,  318,  318,  318,  318,
-      318,  318,  318,  318,  296,  297,  318,  318,  318,  318,
-      318,   67,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  125,  318,
-      318,  318,  318,  318,  318,  318,  318,  204,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  311,  328,  328,  328,  328,  328,  328,
+      328,   62,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,   66,  328,
+      264,  328,  328,  328,  328,  328,  328,  328,  328,  297,
+      298,  328,  328,  328,  328,  328,   67,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
 
-      318,  318,  318,  318,  318,  318,  318,  318,   21,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  153,  318,  318,
-      309,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  103,  318,  318,  318,  318,  318,  318,  318,  271,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  176,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  328,  328,  125,  328,  328,  328,  328,  328,  328,
+      328,  328,  204,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,   21,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  153,  328,  328,  327,  311,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  103,  328,  328,
+      328,  328,  328,  328,  328,  272,  328,  328,  328,  328,
 
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  152,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  102,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,   32,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  176,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  152,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  102,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
 
-      318,  318,  318,   33,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,   64,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  127,  318,
-      318,  318,  318,  318,  120,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,   65,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  236,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  177,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,   32,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,   33,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,   64,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  127,  327,  328,
+      328,  328,  328,  328,  120,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,   65,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  237,  328,  328,  328,  328,  328,  328,  328,
 
-      318,  318,  318,  318,  318,  318,  318,  318,  318,   53,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  254,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,   57,  318,
-       58,  318,  318,  318,  318,  318,  106,  318,  107,  318,
-      318,  318,  318,  104,  318,  318,  318,  318,  318,  318,
+      328,  328,  328,  328,  328,  328,  177,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,   53,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  255,  328,  328,  328,  328,  328,  328,  328,
 
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,    7,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  226,  318,  318,  318,  318,  155,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  237,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,   45,  318,  318,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,   57,  328,   58,  328,  328,  328,  328,  328,  106,
+      328,  107,  328,  328,  328,  328,  104,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,    7,  328,  327,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  226,  328,  328,  328,  328,
+      155,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  238,  328,  328,
 
-      318,  318,  318,  318,  318,   54,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  196,
-      318,  195,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,   16,   17,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,   68,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  203,  318,  318,  318,  318,
-      318,  318,  109,  318,  108,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,   45,  328,  328,  328,  328,  328,  328,
+      328,  328,   54,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  196,  328,  195,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,   16,   17,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
 
-      318,  318,  318,  318,  318,  318,  187,  318,  318,  318,
-      318,  318,  318,  318,  318,  135,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,   87,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      216,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,   91,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,   61,  318,  318,
+       68,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  203,  328,  328,  328,  328,  328,  328,  109,
+      328,  108,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  187,  328,  328,  328,  328,  328,  328,
+      328,  328,  135,  327,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,   87,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  216,
 
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  190,  191,  318,  318,  318,
-      265,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,    6,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  269,  318,  318,  318,  318,
-      318,  318,  290,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,   42,  318,  318,  318,  318,   44,  318,
-      318,  318,  318,  318,  318,  318,  318,   51,  318,  318,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,   91,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,   61,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  190,  191,  328,  328,
+      328,  266,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,    6,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  270,  328,  328,  328,
 
-      318,  318,  318,  318,  318,  318,  183,  318,  318,  318,
-      130,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  208,  318,  184,  318,  318,  318,  223,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,   52,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  132,  114,  318,
-      115,  318,  318,  318,  113,  318,  318,  318,  318,  318,
-      318,  318,  318,  150,  318,  318,   50,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      253,  318,  318,  318,  318,  318,  318,  318,  318,  185,
+      328,  328,  328,  291,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,   42,  328,  328,  328,  328,   44,
+      328,  328,  328,  328,  328,  328,  328,  328,   51,  328,
+      328,  328,  328,  328,  328,  328,  327,  328,  183,  328,
+      328,  328,  130,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  208,  328,  184,  328,  328,  328,  223,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+       52,  328,  328,  328,  328,  328,  328,  328,  328,  328,
 
-      318,  318,  318,  318,  318,  188,  318,  194,  318,  318,
-      318,  318,  318,  222,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  101,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  126,  318,  318,
-      318,  318,  318,  318,   59,  318,  318,  318,   26,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,   20,  318,
-      318,  318,  318,  318,  318,   27,   36,  318,  160,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,   76,   78,
+      328,  132,  114,  328,  115,  328,  328,  328,  113,  328,
+      328,  328,  328,  328,  328,  328,  328,  150,  328,  328,
+       50,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  254,  328,  328,  328,  328,
+      328,  328,  328,  328,  185,  328,  328,  328,  328,  328,
+      188,  328,  194,  328,  328,  328,  328,  328,  222,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  101,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  126,  328,  328,  328,  328,  328,  328,   59,
 
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  273,  318,  318,  318,  234,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  116,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  149,
-      318,   46,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  284,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  154,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  328,  328,   26,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,   20,  328,  328,  328,  328,  328,  328,
+       27,   36,  328,  160,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  327,  328,  328,
+      328,  328,  328,  328,   76,   78,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  274,
+      328,  328,  328,  328,  234,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  116,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  149,  328,   46,
 
-      318,  318,  214,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  293,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  171,  318,  318,  318,  318,  318,
-      318,  318,  318,  110,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  166,  318,  178,  318,  318,  318,  318,
-      318,  138,  318,  318,  318,  318,  318,   97,  318,  318,
-      318,  318,  206,  318,  318,  318,  318,  318,  318,  224,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  245,  318,  318,  318,  318,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  285,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  154,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  214,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  294,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  171,  328,  328,  328,  328,  328,  328,
+      328,  328,  110,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
 
-      318,  318,  318,  318,  318,  131,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  170,
-      318,  318,  318,  318,  318,   79,   80,  318,  318,  318,
-      318,  318,   60,  318,  318,  318,  318,  318,   86,  179,
-      318,  197,  318,  227,  318,  318,  189,  266,  318,  318,
-      318,  318,  318,   72,  318,  181,  318,  318,  318,  318,
-      318,    9,  318,  318,  318,  100,  318,  318,  318,  318,
-      258,  318,  318,  318,  318,  205,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  328,  166,  328,  178,  328,  328,  328,  328,  327,
+      328,  138,  328,  328,  328,  328,  328,   97,  328,  328,
+      328,  328,  206,  328,  328,  328,  328,  328,  328,  224,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  246,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  131,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  170,  328,  328,  328,  328,  328,  328,   79,   80,
+      328,  328,  328,  328,  328,   60,  328,  328,  328,  328,
+      328,   86,  179,  328,  197,  328,  227,  328,  328,  189,
 
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  169,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  156,  318,  272,  318,
-      318,  318,  318,  244,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  218,  318,  318,  318,  318,
-      264,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  287,  318,
-      180,  318,  318,  318,  318,  318,  318,  318,   71,   73,
+      267,  328,  328,  328,  328,  328,   72,  328,  181,  328,
+      328,  328,  328,  328,    9,  328,  328,  328,  100,  328,
+      328,  328,  328,  259,  328,  328,  328,  328,  205,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  327,  328,  328,  328,  328,  169,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      156,  328,  273,  328,  328,  328,  328,  328,  245,  328,
 
-      318,  318,  318,  318,  318,  318,  318,   99,  318,  318,
-      318,  318,  256,  318,  318,  318,  318,  268,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  210,
-       34,   28,   30,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,   35,  318,   29,   31,  318,  318,  318,  318,
-      318,  318,  318,  318,   96,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  212,  209,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,   70,  318,  318,  133,  318,  117,  318,  318,  318,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      218,  328,  301,  328,  328,  328,  265,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  288,  328,  180,  328,  328,
+      328,  328,  328,  328,  328,   71,   73,  328,  328,  328,
+      328,  328,  328,  328,   99,  328,  328,  328,  328,  257,
+      328,  328,  328,  328,  269,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  210,   34,   28,   30,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,   35,
 
-      318,  318,  318,  318,  318,  151,   47,  318,  318,   13,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  282,
-      318,  285,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,   12,  318,  318,   22,  318,  318,  318,  262,
-      318,  318,  318,  318,  270,  318,  318,  318,   74,  318,
-      220,  318,  318,  318,  318,  211,  318,  318,   69,  318,
-      318,  318,  318,   23,  318,   43,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  165,  164,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  213,
-      207,  318,  225,  318,  318,  274,  318,  318,  318,  318,
+      328,   29,   31,  328,  328,  328,  328,  328,  328,  328,
+      328,   96,  328,  328,  328,  328,  328,  328,  327,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      212,  209,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+       70,  328,  328,  133,  328,  117,  328,  328,  328,  328,
+      328,  328,  328,  328,  151,   47,  328,  328,  319,   13,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  283,
+      328,  286,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,   12,  328,  328,   22,  328,  328,  328,  263,
 
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,   81,  318,  318,  318,  257,
-      318,  318,  318,  318,  193,  318,  318,  318,  318,  219,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  291,
-      292,  162,  318,  318,   75,  318,  318,  318,  318,  172,
-      318,  318,  111,  112,  318,  318,  318,  318,  157,  318,
-      159,  318,  198,  318,  318,  318,  318,  163,  318,  318,
-      228,  318,  318,  318,  318,  318,  318,  318,  140,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  328,  328,  328,  271,  328,  328,  328,   74,  328,
+      220,  328,  328,  328,  328,  211,  328,  328,   69,  328,
+      328,  328,  328,   23,  328,   43,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  165,  164,
+      319,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      213,  207,  328,  225,  328,  328,  275,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,   81,  328,  328,
+      328,  258,  328,  328,  328,  328,  193,  328,  328,  328,
 
-      235,  318,  318,  318,  318,  318,  318,  318,   24,  318,
-      267,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  199,  318,  318,  255,  318,  286,
-      318,  192,  318,  318,  318,  318,   55,  318,  318,  318,
-      318,    4,  318,  318,  318,  318,  124,  139,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  231,   37,   38,  318,
-      318,  318,  318,  318,  318,  318,  275,  318,  318,  318,
-      318,  318,  318,  243,  318,  318,  318,  318,  318,  318,
-      318,  202,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  219,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  292,  293,  162,  328,  328,   75,  328,  328,  328,
+      328,  172,  328,  328,  111,  112,  328,  328,  328,  328,
+      157,  328,  159,  328,  198,  328,  328,  328,  328,  163,
+      328,  328,  228,  328,  328,  328,  328,  328,  328,  328,
+      140,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  236,  328,  328,  328,  328,  328,  328,
+      328,   24,  328,  268,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  199,  328,  328,
+      256,  328,  287,  328,  192,  328,  328,  328,  328,   55,
 
-      318,  318,  318,   84,  318,   56,  261,  318,  232,  318,
-      318,  318,  318,   11,  318,  318,  318,  318,  318,  318,
-      123,  318,  318,  318,  318,  200,   88,  318,   40,  318,
-      318,  318,  318,  318,  318,  318,  318,  168,  318,  318,
-      318,  318,  318,  142,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  242,  318,  318,  318,  318,  136,  318,
-      318,  118,  119,  318,  318,  318,   90,   94,   89,  318,
-      318,  318,   82,  318,  318,  318,  318,  318,   10,  318,
-      318,  318,  259,  294,  318,  318,  318,  318,  299,   39,
-      318,  318,  318,  318,  318,  167,  318,  318,  318,  318,
+      328,  328,  328,  328,    4,  328,  328,  328,  328,  124,
+      139,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  231,
+       37,   38,  328,  328,  328,  328,  328,  328,  328,  276,
+      328,  328,  328,  328,  328,  328,  328,  244,  328,  328,
+      328,  328,  328,  328,  328,  202,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,   84,  328,   56,
+      262,  328,  232,  328,  328,  328,  328,   11,  328,  328,
+      328,  328,  328,  328,  123,  328,  328,  328,  328,  200,
+       88,  328,   40,  328,  328,  328,  328,  328,  328,  328,
 
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,   95,   93,
-      318,  318,  318,   83,  283,  318,  318,  318,  318,  318,
-      318,  318,  186,  318,  318,  318,  318,  318,  201,  318,
-      318,  318,  318,  318,  318,  318,  318,  158,   77,  318,
-      318,  318,  318,  318,  276,  318,  318,  318,  318,  318,
-      318,  318,  239,  318,  318,  238,  137,  318,   92,   48,
-      318,  143,  144,  147,  148,  145,  146,   85,  318,  260,
-      318,  318,  318,  318,  161,  318,  318,  318,  318,  318,
-      230,  318,  318,  318,  318,  318,  318,  318,  318,  318,
+      328,  168,  328,  328,  328,  328,  328,  142,  328,  328,
+      328,  328,  235,  328,  328,  328,  328,  328,  243,  328,
+      328,  328,  328,  136,  328,  328,  118,  119,  328,  328,
+      328,   90,   94,   89,  328,  328,  328,   82,  328,  328,
+      328,  328,  328,   10,  328,  328,  328,  260,  295,  328,
+      328,  328,  328,  300,   39,  328,  328,  328,  328,  328,
+      167,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,   95,   93,  328,  328,  328,   83,  284,
+      328,  328,  328,  328,  328,  328,  328,  186,  328,  328,
 
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  174,
-      173,   41,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,   98,  318,  229,
-      318,  252,  280,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,   49,    5,  318,  318,  221,
-      318,  318,  281,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  240,   25,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  241,  318,  318,  318,
-      141,  318,  318,  318,  318,  318,  318,  318,  318,  175,
+      328,  328,  328,  201,  328,  328,  328,  328,  328,  328,
+      328,  328,  158,   77,  328,  328,  328,  328,  328,  277,
+      328,  328,  328,  328,  328,  328,  328,  240,  328,  328,
+      239,  137,  328,   92,   48,  328,  143,  144,  147,  148,
+      145,  146,   85,  328,  261,  328,  328,  328,  328,  161,
+      328,  328,  328,  328,  328,  230,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  174,  173,   41,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
 
-      318,  182,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  277,  318,  318,  318,  318,  318,  318,  318,  318,
-      318,  318,  318,  318,  318,  318,  318,  318,  318,  298,
-      318,  318,  248,  318,  318,  318,  318,  318,  278,  318,
-      318,  318,  318,  318,  318,  279,  318,  318,  318,  246,
-      318,  249,  250,  318,  318,  318,  318,  318,  247,  251,
-        0
+      328,  328,   98,  328,  229,  328,  253,  281,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+       49,    5,  328,  328,  221,  328,  328,  282,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  241,   25,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  242,  328,  328,  328,  141,  328,  328,  328,  328,
+      328,  328,  328,  328,  175,  328,  182,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  278,  328,  328,  328,
+      328,  328,  328,  328,  328,  328,  328,  328,  328,  328,
+      328,  328,  328,  328,  299,  328,  328,  249,  328,  328,
+
+      328,  328,  328,  279,  328,  328,  328,  328,  328,  328,
+      280,  328,  328,  328,  247,  328,  250,  251,  328,  328,
+      328,  328,  328,  248,  252,    0
     } ;
 
 static const YY_CHAR yy_ec[256] =
@@ -755,2082 +762,2128 @@ static const YY_CHAR yy_meta[41] =
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1
     } ;
 
-static const flex_int16_t yy_base[3176] =
+static const flex_int16_t yy_base[3245] =
     {   0,
         0,    0,   38,   41,   44,   46,   59,   65,   71,   77,
-       90,  112, 2341, 2249,   81, 6159, 6159, 6159,   96,   52,
-      106,   63,  107,  128,   70,  116,  125,  132,   57,   88,
-       76,  149,  151,  114,  160,   97,  161,  181,  170,  180,
-      154,  123, 1910, 6159, 6159, 6159,  139, 1900, 6159, 6159,
-     6159,  151, 1839, 1690, 6159, 6159, 6159,  202, 1346, 6159,
-     6159, 6159,  212, 1221, 6159,  216, 6159,  220,  183, 1188,
-      224,  132,    0,  231,    0,    0,  225,  187,   85,  220,
-      147,  226,  233,  227,  234,  237,  238,  235,  218,  239,
-      247,  242,  248,  246,  257,  255,  259,  261,  263,  267,
+       90,  112,   96,  118,  124,  136, 4264, 3883,   81, 6299,
+     6299, 6299,  129,   52,  130,   63,  131,  152,   70,  140,
+      149,  156,   57,   88,   76,  173,  175,   95,  184,  145,
+      185,  205,  194,  204,  178,  123, 3532, 6299, 6299, 6299,
+      107, 3462, 6299, 6299, 6299,  154, 3335, 2925, 6299, 6299,
+     6299,  226, 2336, 6299, 6299, 6299,  163, 2298, 6299,  238,
+     6299,  242,  148, 1838, 1641, 6299, 6299, 6299,  246, 1331,
+     6299, 6299, 6299,  250, 1145,  254,  219,    0,  258,    0,
+        0,  165,  250,  191,  215,  243,  252,  256,   92,  260,
 
-      264,  279,  281,  270,  286,  287,  284,  274,  292,  295,
-      280,  297,  301,  305,  306,  309,  312,  317,  307,  315,
-      318,  328,  319,  320,  321,  336,  329,  337,  323,  343,
-      345,  333,  348,  351,  353,  355,  356,  360,  358,  359,
-      371,  373,  944,  384,  874,  389,  830,  393,  811,  716,
-      398,  362,  402,  406,    0,  398,  380,  408,  391,  400,
-      403,  405,  404,  407,  410,  414,  413,  420,  427,  422,
-      430,  423,  437,  436,  440,  441,  438,  432,  443,  452,
-      446,  445,  459,  462,  463,  455,  464,  469,  473,  472,
-      470,  474,  491,  476,  467,  477,  486,  498,  500,  489,
+      261,  262,  264,  265,  266,  273,  270,  277,  278,  281,
+      271,  279,  290,  288,  296,  295,  299,  310,  303,  306,
+      313,  314,  307,  323,  317,  312,  328,  326,  330,  334,
+      337,  340,  342,  343,  344,  346,  349,  354,  348,  356,
+      364,  357,  361,  359,  372,  376,  365,  360,  377,  380,
+      384,  385,  387,  388,  391,  399,  389, 1088,  411,  855,
+      415,  776,  422,  778,  644,  426,  406,  430,  434,    0,
+      411,  280,  438,  233,  181,  442,  430,  442,  419,  438,
+      439,  441,  440,  443,  444,  445,  446,  449,  463,  455,
+      456,  467,  471,  472,  469,  476,  474,  460,  482,  488,
 
-      496,  507,  508,  503,  510,  513,  520,  521,  505,  519,
-      522,  523,  525,  526,  527,  529,  533,  530,  534,  536,
-      537,  546,  550,  541,  547,  544,  560,  553,  562,  558,
-      563,  565,  561,  569,  570,  579,  574,  581,  577,  582,
-      583,  586,  594,  597,  590,   75,  595,  587,  598,  602,
-      601,  603,  604,  611,  613,  614,  615,  622,  618,  623,
-      606,  625,  626,  628,  635,  638,  630,  642,  647,  631,
-      645,  650,  636,  640,  654,  656,  658,  659,  669,  648,
-      670,  671,  672,  661,  674,  676,  683,  684,  679,  680,
-      685,  687,  688,  690,  686,  691,  692,  694,  696,  701,
+      484,  481,  491,  494,  495,  497,  502,  503,  505,  504,
+      506,  507,  523,  510,  499,  509,  532,  530,  534,  539,
+      535,  542,  544,  537,  551,  547,  554,  556,  557,  508,
+      559,  546,  561,  549,  560,  562,  569,  563,  570,  573,
+      576,  583,  579,  580,  586,  578,  587,  588,  597,  592,
+      594,  593,  601,  602,  610,  611,  603,  614,  613,  615,
+      616,  619,  627,  630,  631,  623,  632,  626,  628,  634,
+      635,  636,  639,  649,  654,  651,  652,  659,  658,  660,
+      661,  663,  664,  640,  675,  667,  666,  680,  685,  671,
+      683,  686,  676,  678,  688,  690,  695,  696,  703,  698,
 
-      702,  708,  713,  714,  709,  723,  715,  710,  725,  726,
-      733,  737,  727,  746,  757,  752,  744,  738,  745,  758,
-      760,  763,  765,  762,  769,  770,  771,  772,  773,  781,
-      783, 6159,  776,  780,  793,  789,  797,  798,  791,  804,
-      800,  778,  812,  811,  813,  819,  841,  814,  815,  816,
-      824,  821, 6159,  826,  833,  865,  837,  846,  849,  850,
-      817,  851,  854,  863,  859,  882,  827,  866,  861,  889,
-      871,  885,  887,  858,  890,  888,  897,  898,  892,  896,
-      900,  910,  901,  718,  906,  918,  902,  909,  913,  917,
-      919,  928,  920,  923,  932,  934,  935,  936,  937,  940,
+      706,  699,  708,  707,  709,  713,  720,  721,  716,  717,
+      722,  719,  723,  726,  727,  730,  725,  731,  737,  733,
+      739,  741,  752,  747,  748,  761,  754,  756,  757,  764,
+      755,  771,  765,  786,  793,  772,  782,  768,  791,  794,
+      796,  801,  797,  790,  804,  807,  808,  810,  811,  818,
+      813, 6299,  815,  817,  829,  828,  831,  834,  824,  840,
+      832,  820,  850,  846,  847,  851,  873,  848,  849,  862,
+      863,  853, 6299,  866,  857,  897,  865,  875,  887,  882,
+      858,  883,  890,  895,  891,  907,  893,  898,  903,  920,
+      906,  908,  915,  921,  922,  923,  931,  932,  926,  930,
 
-      938,  951,  945,  957,  941,  959,  961,  949,  962,  967,
-      971,  974,  976,  972,  978,  980,  985,  982,  986,  988,
-      996,  991,  994,  997,  998, 1000, 1001, 1004, 1006, 1007,
-     1008, 1011, 1013, 1012, 1021, 1023, 1015, 1029, 1019, 6159,
-     1031, 1027, 1034, 1035, 1033, 1037, 6159, 1038, 1039, 1040,
-     1051, 1043, 1061, 1057, 1046, 1063, 1047, 1064, 1065, 1072,
-     1067, 1070, 1075, 1068, 1076, 1077, 1079, 1084, 1085, 1083,
-     1086, 1089, 1092, 1094, 1112, 6159, 1095, 1101, 1102, 1103,
-     1108, 1110, 1125, 1104, 1135, 1117, 1137, 1145, 1127, 1141,
-     1129, 1142, 1096, 1123, 1153, 1149, 1109, 1151, 1155, 1147,
+      934,  943,  939,  940,  944,  953,  941,  947,  952,  945,
+      955,  967,  954,  962,  971,  960,  965,  973,  974,  976,
+      975,  986,  983,  985,  988,  978,  996, 1007,  998, 1002,
+     1006, 1009, 1011, 1013, 1014, 1017, 1021, 1018, 1022, 1024,
+     1032, 1027, 1028, 1029, 1034, 1036, 1037, 1040, 1042, 1045,
+     1044, 1048, 1049, 1047, 1054, 1060, 1057, 1066, 1058, 6299,
+     1068, 1061, 1064, 1070, 1071, 1073, 6299, 1074, 1075, 1076,
+     1083, 1084, 1087, 1096, 1086, 1097, 1099, 1089, 1098, 1110,
+     1106, 1109, 1117, 1107, 1114, 1115, 1118, 1116, 1122, 1123,
+     1124, 1125, 1128, 1130, 1148, 6299, 1131, 1140, 1132, 1133,
 
-     1156, 1158, 1157, 1160, 1159, 6159, 1163, 1173, 1184, 1168,
-     1170, 1171, 1179, 1181, 1182, 1183, 1186, 1189, 1194, 1198,
-     1201, 1192, 1209, 1205, 1207, 1206, 1208, 1211, 1212, 1213,
-     1214, 1225, 1218, 1227, 1234, 1241, 1237, 1239, 1246, 1248,
-     1228, 1250, 1251, 1243, 1244, 1254, 1255, 1245, 1258, 1259,
-     1267, 1265, 1264, 1266, 1270, 1272, 1274, 1275, 1276, 1278,
-     1279, 1286, 1283, 1287, 1290, 1285, 1291, 1295, 1300, 1304,
-     1305, 1297, 1306, 6159, 1314, 1315, 1317, 1318, 1307, 1323,
-     1325, 1319, 1327, 1329, 1328, 1332, 1331, 1334, 1338, 1339,
-     1340, 1343, 1342, 1355, 1353, 1357, 1364, 1363, 1365, 1350,
+     1134, 1142, 1160, 1144, 1153, 1157, 1161, 1172, 1163, 1175,
+     1171, 1180, 1181, 1183, 1184, 1186, 1187, 1188, 1190, 1189,
+     1191, 1193, 1195, 1192, 1198, 6299, 1197, 1212, 1219, 1205,
+     1210, 1215, 1218, 1220, 1221, 1222, 1223, 1227, 1230, 1241,
+     1237, 1233, 1248, 1243, 1244, 1246, 1249, 1251, 1250, 1252,
+     1254, 1263, 1259, 1266, 1274, 1275, 1277, 1279, 1286, 1288,
+     1281, 1283, 1289, 1285, 1284, 1291, 1293, 1300, 1294, 1297,
+     1224, 1304, 1306, 1301, 1307, 1308, 1313, 1309, 1311, 1315,
+     1318, 1321, 1329, 1325, 1326, 1335, 1327, 1336, 1328, 1333,
+     1339, 1348, 1342, 1350, 6299, 1357, 1258, 1352, 1354, 1359,
 
-     1367, 1375, 1371, 1378, 1374, 1379, 1386, 1382, 1383, 1387,
-     1394, 1389, 1390, 1393, 1391, 1400, 1397, 1402, 1409, 1410,
-     1412, 1419, 1414, 1348, 1421, 1416, 1424, 1425, 1427, 1428,
-     1429, 1430, 1437, 1432, 1433, 1434, 1438, 1439, 1440, 1444,
-     1447, 1458, 1441, 1451, 1454, 1460, 1461, 1464, 1467, 1466,
-     1468, 1469, 1470, 1471, 1476, 1474, 1472, 1481, 1480, 1490,
-     1489, 1493, 1496, 1497, 1498, 1499, 1502, 1508, 1500, 1510,
-     1511, 1501, 1514, 1516, 1519, 1522, 1526, 1521, 1527, 1529,
-     1531, 1532, 1534, 1537, 1540, 1541, 6159, 1542, 1549, 1547,
-     1548, 1551, 1554, 1555, 1562, 1557, 1559, 1558, 1560, 1564,
+     1360, 1361, 1362, 1367, 1368, 1369, 1371, 1370, 1373, 1374,
+     1377, 1379, 1384, 1386, 1387, 1388, 1389, 1402, 1401, 1403,
+     1391, 1397, 1412, 1405, 1413, 1414, 1415, 1422, 1418, 1419,
+     1423, 1430, 1425, 1426, 1429, 1427, 1436, 1433, 1438, 1445,
+     1446, 1448, 1455, 1450, 1452, 1457, 1460, 1461, 1462, 1464,
+     1465, 1466, 1467, 1474, 1469, 1472, 1471, 1475, 1470, 1476,
+     1484, 1478, 1497, 1489, 1492, 1494, 1498, 1501, 1500, 1499,
+     1502, 1506, 1507, 1509, 1508, 1510, 1512, 1519, 1521, 1523,
+     1528, 1527, 1529, 1531, 1534, 1530, 1539, 1540, 1542, 1536,
+     1549, 1550, 1551, 1552, 1555, 1553, 1557, 1562, 1563, 1564,
 
-     1586, 6159, 1568, 6159, 6159,  157, 6159, 6159, 1569, 1571,
-     6159, 1574, 1572, 1589, 1581, 1596, 1590, 1592, 1599, 1587,
-     1600, 1614, 1570, 1602, 1604, 1620, 1603, 1625, 1612, 1609,
-     1619, 1611, 1635, 1631, 1637, 1639, 1641, 1642, 1645, 1646,
-     1647, 1654, 1655, 1648, 1651, 1658, 1659, 1661, 1663, 1664,
-     1666, 1668, 1672, 1667, 1674, 1669, 1683, 1684, 1676, 1693,
-     6159, 1690, 1694, 1702, 1698, 1705, 1697, 1701, 1704, 1709,
-     1711, 1706, 1713, 1715, 1716, 1717, 1719, 1721, 1724, 1728,
-     1725, 6159, 1726, 1729, 1727, 1734, 1733, 1737, 1741, 1743,
-     1745, 1747, 1748, 1755, 1752, 1750, 1758, 1759, 1760, 1763,
+     1568, 1570, 1569, 1572, 1578, 1575, 1576, 6299, 1580, 1588,
+     1581, 1589, 1586, 1591, 1592, 1600, 1595, 1597, 1596, 1602,
+     1605, 1628, 6299, 1606, 6299, 6299,  315, 6299, 6299, 1608,
+     1607, 6299, 1609, 1611, 1618, 1619, 1631, 1635, 1638, 1624,
+     1612, 1639, 1651, 1660, 1641, 1622, 1652, 1653, 1644, 1654,
+     1666, 1655, 1665, 1656, 1673, 1683, 1684, 1685, 1675, 1687,
+     1689, 1692, 1693, 1697, 1699, 1700, 1702, 1703, 1704, 1706,
+     1705, 1708, 1711, 1714, 1715, 1717, 1710, 1718, 1669, 1727,
+     1720, 1737, 6299, 1729, 1739, 1744, 1741, 1748, 1747, 1743,
+     1745, 1752, 1755, 1756, 1757, 1758, 1723, 1759, 1761, 1762,
 
-     6159, 1762, 1772, 1767, 1773, 1769, 1775, 1776, 1779, 1780,
-     1782, 1781, 1783, 1785, 1786, 1798, 1793, 1794, 1789, 1797,
-     1807, 1809, 1810, 1817, 1799, 1812, 1814, 1818, 1820, 1822,
-     1824, 1825, 1833, 1835, 1828, 1836, 1831, 1838, 1847, 1846,
-     1837, 1848, 1849, 1852, 1857, 1859, 1861, 1862, 1863, 1871,
-     1855, 1867, 1869, 1872, 1879, 1870, 1882, 1883, 1874, 1881,
-     1888, 1889, 6159, 1890, 1891, 6159, 1892, 1894, 1916, 1897,
-     1895, 1902, 1904, 1906, 1907, 1909, 1920, 1913, 1922, 1929,
-     1926, 1935, 1930, 1933, 1941, 1942, 1943, 1944, 1946, 1949,
-     1950, 1961, 1968, 1964, 1959, 1972, 1952, 1967, 1969, 1988,
+     1765, 1772, 1767, 6299, 1768, 1770, 1769, 1776, 1774, 1782,
+     1784, 1780, 1787, 1788, 1790, 1801, 1791, 1796, 1798, 1799,
+     1802, 1804, 6299, 1814, 1806, 1809, 1813, 1810, 1819, 1820,
+     1821, 1822, 1823, 1824, 1825, 1827, 1833, 1834, 1835, 1836,
+     1837, 1841, 1851, 1846, 1849, 1859, 1850, 1853, 1861, 1863,
+     1864, 1865, 1866, 1868, 1873, 1875, 1872, 1880, 1876, 1883,
+     1895, 1878, 1879, 1890, 1892, 1891, 1893, 1905, 1900, 1901,
+     1904, 1913, 1906, 1909, 1911, 1915, 1922, 1918, 1923, 1924,
+     1914, 1928, 1930, 1931, 6299, 1932, 1937, 6299, 1934, 1938,
+     1960, 1939, 1941, 1942, 1944, 1947, 1949, 1946, 1952, 1962,
 
-     1970, 1971, 1977, 1973, 1978, 1975, 1984, 1981, 1990, 1993,
-     1983, 2003, 2000, 1998, 2001, 2004, 2011, 2015, 6159, 2024,
-     2020, 2006, 2013, 2027, 2028, 2029, 6159, 2030, 2031, 2034,
-     2038, 2035, 2036, 2037, 2041, 2043, 2045, 2046, 2047, 2051,
-     2053, 2049, 2068, 6159, 2054, 6159, 2063, 2052, 2064, 2067,
-     2069, 2071, 2073, 2074, 6159, 6159, 2075, 2076, 2088, 2090,
-     2082, 6159, 2091, 2098, 2099, 2093, 2094, 2101, 2102, 2104,
-     2106, 2105, 2115, 2110, 2117, 2112, 2123, 2124, 6159, 2113,
-     2114, 2126, 2129, 2125, 2132, 2139, 2133, 6159, 2136, 2140,
-     2143, 2152, 2148, 2150, 2151, 2154, 2160, 2153, 2155, 2158,
+     1964, 1974, 1970, 1975, 1980, 1977, 1982, 1983, 1985, 1986,
+     1988, 1991, 1993, 1998, 1994, 2007, 2012, 2011, 2008, 2019,
+     2014, 2015, 2017, 2037, 2016, 2018, 2025, 2020, 2021, 2024,
+     2033, 2026, 2027, 2030, 2031, 2048, 2050, 2044, 2052, 2053,
+     2059, 2060, 2054, 6299, 2067, 1955, 2065, 2066, 2075, 2072,
+     2070, 6299, 2073, 2076, 2078, 2086, 2081, 2083, 2087, 2088,
+     2091, 2093, 2095, 2097, 2100, 2098, 2099, 2117, 6299, 2096,
+     6299, 2101, 2103, 2110, 2114, 2118, 2119, 2120, 2121, 6299,
+     6299, 2122, 2124, 2130, 2138, 2135, 6299, 2137, 2145, 2142,
+     2147, 2140, 2141, 2149, 2151, 2155, 2152, 2162, 2157, 2164,
 
-     2162, 2163, 2170, 2172, 2168, 2175, 2177, 2185, 6159, 2181,
-     2167, 2189, 2186, 2193, 2188, 2194, 2184, 2190, 2195, 2201,
-     2196, 2200, 2205, 2206, 2214, 2216, 2211, 2215, 2213, 2219,
-     2221, 2222, 2227, 2224, 2228, 2229, 2230, 6159, 2231, 2233,
-      271, 2239, 2236, 2240, 2241, 2245, 2244, 2247, 2262, 2263,
-     2259, 2258, 2261, 2265, 2268, 2269, 2270, 2271, 2273, 2272,
-     2275, 6159, 2277, 2278, 2281, 2283, 2289, 2284, 2286, 6159,
-     2296, 2288, 2307, 2301, 2303, 2309, 2310, 2313, 2311, 2314,
-     2315, 2316, 2318, 2321, 2322, 6159, 2325, 2330, 2333, 2326,
-     2337, 2336, 2339, 2343, 2344, 2345, 2349, 2347, 2350, 2351,
+     2159, 2166, 2170, 6299, 2160, 2172, 2173, 2175, 2176, 2181,
+     2182, 2179, 6299, 2183, 2185, 2188, 2196, 2198, 2195, 2199,
+     2200, 2205, 2202, 2207, 2208, 2209, 2210, 2219, 2221, 2211,
+     2222, 2224, 2231, 6299, 2214, 2218, 2236, 2234, 2241, 2233,
+     2235, 2237, 2243, 2245, 2246, 2247, 2250, 2251, 2252, 2259,
+     2260, 2257, 2256, 2265, 2266, 2267, 2270, 2273, 2274, 2275,
+     2276, 2277, 6299, 2278, 2280, 2283,  171, 2286, 2289, 2287,
+     2288, 2296, 2291, 2294, 2307, 2312, 2308, 2309, 2310, 2316,
+     2317, 2318, 2319, 2320, 2321, 2322, 2324, 6299, 2326, 2327,
+     2329, 2333, 2332, 2335, 2340, 6299, 2342, 2349, 2352, 2361,
 
-     2352, 2353, 2354, 2360, 2355, 2356, 2365, 2368, 2367, 2369,
-     2375, 2373, 2378, 2379, 6159, 2386, 2381, 2383, 2384, 2389,
-     2390, 2406, 2392, 2396, 2401, 2407, 2415, 2403, 2409, 2419,
-     2421, 2412, 2426, 2431, 2427, 2436, 2429, 2433, 2439, 2442,
-     2437, 2443, 2444, 2446, 2450, 2448, 2449, 2458, 2465, 2451,
-     2460, 2463, 2468, 2473, 2474, 6159, 2476, 2475, 2478, 2482,
-     2493, 2486, 2484, 2489, 2488, 2498, 2497, 2499, 2500, 2509,
-     2504, 2511, 2501, 2508, 2510, 2512, 2517, 2520, 2522, 2526,
-     2523, 2529, 2530, 6159, 2531, 2536, 2533, 2537, 2540, 2542,
-     2544, 2547, 2549, 2550, 2551, 2556, 2553, 2557, 2558, 2559,
+     2344, 2353, 2362, 2358, 2363, 2364, 2366, 2368, 2370, 2369,
+     2372, 2378, 2375, 6299, 2380, 2383, 2385, 2376, 2392, 2391,
+     2384, 2398, 2399, 2400, 2403, 2401, 2402, 2405, 2404, 2406,
+     2407, 2412, 2411, 2408, 2410, 2420, 2421, 2422, 2431, 2424,
+     2432, 2433, 6299, 2440, 2435, 2437, 2438, 2439, 2452, 2442,
+     2461, 2444, 2448, 2445, 2464, 2466, 2456, 2467, 2478, 2480,
+     2468, 2477, 2488, 2487, 2490, 2483, 2470, 2493, 2496, 2497,
+     2498, 2500, 2502, 2503, 2504, 2505, 2512, 2513, 2510, 2520,
+     2519, 2525, 2532, 2527, 6299, 2536, 2531, 2534, 2541, 2548,
+     2544, 2521, 2549, 2545, 2551, 2555, 2556, 2557, 2564, 2561,
 
-     2561, 2563, 2566, 6159, 2574, 2567, 2575, 2569, 2576, 2579,
-     2585, 2586, 2588, 2592, 2593, 2594, 2595, 2596, 6159, 2604,
-     2605, 2601, 2613, 2603, 2608, 2610, 2615, 2616, 6159, 2617,
-     2618, 2625, 2626, 2622, 6159, 2629, 2624, 2630, 2631, 2632,
-     2633, 2634, 2639, 2640, 2642, 2647, 2649, 2645, 2653, 6159,
-     2654, 2662, 2657, 2655, 2663, 2666, 2667, 2669, 2678, 2670,
-     2674, 6159, 2685, 2677, 2689, 2696, 2691, 2676, 2693, 2692,
-     2694, 2698, 2701, 2703, 6159, 2704, 2707, 2708, 2712, 2705,
-     2714, 2715, 2727, 2717, 2719, 2722, 2720, 2724, 2728, 2737,
-     2733, 2741, 2730, 2743, 2744, 2749, 2750, 2731, 2753, 2761,
+     2565, 2563, 2567, 2566, 2569, 2568, 2570, 2576, 2583, 2579,
+     2585, 2587, 6299, 2511, 2588, 2590, 2591, 2597, 2592, 2599,
+     2601, 2603, 2604, 2605, 2607, 2610, 2611, 2613, 2615, 2618,
+     2617, 2616, 6299, 2621, 2622, 2623, 2629, 2631, 2632, 2639,
+     2641, 2647, 2645, 2635, 2649, 2651, 2652, 6299, 2660, 2662,
+     2659, 2663, 2661, 2666, 2667, 2669, 2671, 6299, 2672, 2673,
+     2674, 2681, 2682, 2677, 6299, 2686, 2684, 2679, 2688, 2689,
+     2690, 2694, 2692, 2696, 2701, 2702, 2706, 2709, 2710, 6299,
+     2711, 2723, 2713, 2716, 2718, 2714, 2720, 2724, 2729, 2727,
+     2738, 2733, 6299, 2749, 2638, 2741, 2751, 2744, 2746, 2748,
 
-     2756, 2758, 2760, 2762, 2763, 2771, 2773, 2774, 2776, 6159,
-     2779, 2780, 2772, 2769, 2782, 2785, 2786, 2788, 2790, 2791,
-     2792, 2794, 2795, 2804, 2807, 2802, 2811, 2805, 2809, 2816,
-     2813, 2815, 2817, 2820, 2827, 2826, 2819, 2829, 2830, 2833,
-     2841, 2832, 2836, 2840, 2842, 2843, 2844, 2847, 2852, 2860,
-     2846, 2867, 2869, 2870, 2850, 2864, 2871, 2872, 2876, 6159,
-     2856, 2879, 2873, 2881, 2883, 2887, 2889, 2896, 2891, 2892,
-     2893, 2900, 2903, 2897, 2902, 2908, 2915, 2911, 6159, 2912,
-     6159, 2913, 2914, 2921, 2924, 2916, 6159, 2926, 6159, 2929,
-     2938, 2923, 2927, 6159, 2941, 2931, 2933, 2945, 2935, 2940,
+     2753, 2754, 2755, 2756, 2757, 2760, 6299, 2761, 2764, 2765,
+     2767, 2770, 2769, 2771, 2784, 2777, 2779, 2781, 2785, 2786,
+     2788, 2791, 2792, 2797, 2793, 2794, 2804, 2806, 2808, 2809,
+     2812, 2816, 2814, 2819, 2820, 2815, 2822, 2825, 2833, 2838,
+     2823, 2834, 6299, 2837, 2840, 2839, 2841, 2842, 2845, 2846,
+     2849, 2847, 2854, 2852, 2851, 2855, 2864, 2872, 2861, 2868,
+     2870, 2873, 2875, 2877, 2876, 2878, 2879, 2886, 2883, 2885,
+     2893, 2890, 2894, 2902, 2891, 2899, 2901, 2903, 2905, 2904,
+     2906, 2907, 2912, 2914, 2917, 2924, 2927, 2929, 2928, 2930,
+     2931, 2934, 6299, 2937, 2938, 2935, 2942, 2945, 2947, 2949,
 
-     2947, 2948, 2949, 2954, 2956, 2952, 2957, 2958, 2959, 2962,
-     2964, 2968, 2969, 2975, 2967, 2977, 2978, 2980, 2981, 2985,
-     2986, 2988, 6159, 2991, 2994, 2987, 2995, 2996, 2998, 2999,
-     3003, 3004, 3006, 3007, 3013, 3009, 3017, 3020, 3027, 3011,
-     3028, 6159, 3030, 3033, 3034, 3035, 6159, 3037, 3036, 3038,
-     3045, 3040, 3043, 3047, 3048, 3049, 3052, 3055, 3063, 3065,
-     3067, 3068, 6159, 3070, 3073, 3057, 3074, 3084, 3086, 3085,
-     3088, 3091, 3099, 3095, 3094, 3058, 3096, 3097, 3098, 3108,
-     3109, 3105, 3112, 3104, 3111, 3114, 3118, 3119, 3120, 3121,
-     3122, 3124, 3125, 3126, 3128, 3129, 3130, 6159, 3133, 3134,
+     2957, 2948, 2952, 2959, 2956, 2966, 2958, 2967, 2968, 2975,
+     2972, 6299, 2973, 6299, 2974, 2976, 2979, 2983, 2982, 6299,
+     2987, 6299, 2989, 2994, 2984, 2990, 6299, 2996, 2997, 2998,
+     3003, 3001, 3005, 3008, 3009, 3010, 3011, 3013, 3015, 3019,
+     3018, 3020, 3023, 3028, 3025, 3029, 3032, 3035, 3036, 3040,
+     3038, 3042, 3045, 3047, 3050, 6299, 3052, 3048, 3054, 3057,
+     3058, 3059, 3061, 3062, 3065, 3067, 3068, 3074, 3075, 3069,
+     3079, 3085, 3082, 3084, 3097, 6299, 3092, 3094, 3095, 3096,
+     6299, 3098, 3099, 3100, 3107, 3105, 3109, 3110, 3112, 3116,
+     3111, 3118, 3113, 3128, 3126, 3132, 3121, 6299, 3135, 3136,
 
-     3148, 3132, 3135, 3143, 3146, 6159, 3151, 3154, 3156, 3158,
-     3160, 3162, 3163, 3164, 3168, 3165, 3166, 3169, 3170, 6159,
-     3179, 6159, 3171, 3185, 3184, 3190, 3191, 3192, 3195, 3201,
-     3193, 3197, 3202, 3204, 3205, 3211, 3208, 3212, 3213, 3214,
-     3221, 3219, 3220, 3226, 3228, 3229, 3232, 3230, 6159, 6159,
-     3233, 3234, 3235, 3237, 3238, 3244, 3250, 3245, 3255, 3241,
-     3256, 3261, 3268, 6159, 3264, 3266, 3263, 3269, 3276, 3271,
-     3273, 3286, 3282, 3290, 3288, 6159, 3275, 3283, 3298, 3291,
-     3293, 3305, 6159, 3300, 6159, 3301, 3303, 3306, 3307, 3310,
-     3311, 3312, 3313, 3318, 3315, 3325, 3321, 3329, 3330, 3331,
+     3122, 3139, 3149, 3151, 3156, 3138, 3152, 3154, 3163, 3159,
+     3158, 3160, 3161, 3162, 3165, 3172, 3173, 3169, 3176, 3175,
+     3179, 3186, 3183, 3177, 3181, 3187, 3189, 3190, 3191, 3192,
+     3193, 3194, 3197, 6299, 3199, 3200, 3202, 3214, 3206, 3209,
+     3213, 3217, 6299, 3220, 3221, 3223, 3224, 3222, 3230, 3231,
+     3232, 3233, 3234, 3236, 3239, 3240, 6299, 3245, 6299, 3246,
+     3254, 3253, 3259, 3235, 3261, 3263, 3268, 3262, 3264, 3269,
+     3272, 3270, 3276, 3273, 3278, 3281, 3285, 3286, 3288, 3284,
+     3295, 3291, 3296, 3298, 3299, 6299, 6299, 3300, 3301, 3302,
+     3305, 3306, 3307, 3316, 3318, 3323, 3320, 3313, 3322, 3342,
 
-     3332, 3333, 3341, 3336, 3337, 3338, 6159, 3343, 3340, 3344,
-     3347, 3354, 3357, 3355, 3345, 6159, 3361, 3366, 3363, 3367,
-     3369, 3371, 3372, 3373, 3375, 3377, 3374, 3378, 3390, 3383,
-     3381, 3385, 3397, 3400, 3402, 6159, 3404, 3405, 3412, 3408,
-     3410, 3392, 3413, 3411, 3415, 3417, 3418, 3419, 3420, 3421,
-     3423, 3425, 3432, 3426, 3439, 3440, 3427, 3448, 3434, 3443,
-     6159, 3449, 3450, 3452, 3453, 3457, 3458, 3461, 3463, 3456,
-     3470, 3474, 3465, 3467, 3478, 3479, 3487, 3482, 6159, 3490,
-     3480, 3495, 3491, 3493, 3500, 3492, 3497, 3504, 3494, 3501,
-     3507, 3511, 3509, 3510, 3513, 3520, 3517, 6159, 3525, 3518,
+     6299, 3329, 3324, 3326, 3332, 3350, 3333, 3346, 3353, 3349,
+     3358, 3355, 6299, 3356, 3357, 3365, 3360, 3363, 3368, 6299,
+     3367, 6299, 3364, 3369, 3370, 3377, 3374, 3379, 3380, 3381,
+     3385, 3396, 3397, 3389, 3399, 3393, 3382, 3401, 3403, 3410,
+     3405, 3407, 3408, 6299, 3412, 3409, 3414, 3417, 3419, 3425,
+     3428, 3415, 6299, 3421, 3431, 3435, 3432, 3436, 3439, 3441,
+     3442, 3443, 3445, 3447, 3444, 3449, 3460, 3452, 3453, 3455,
+     3466, 3467, 3473, 6299, 3474, 3468, 3481, 3483, 3476, 3478,
+     3484, 3485, 3486, 3489, 3491, 3490, 3492, 3493, 3494, 3496,
+     3498, 3501, 3499, 3512, 3513, 3500, 3521, 3522, 3504, 6299,
 
-     3527, 3531, 3526, 3540, 3535, 3536, 3538, 3546, 3539, 3547,
-     3543, 3549, 3550, 3553, 3554, 6159, 6159, 3558, 3555, 3560,
-     6159, 3561, 3562, 3572, 3568, 3564, 3573, 3575, 3577, 3576,
-     3578, 3581, 3584, 6159, 3587, 3595, 3590, 3591, 3599, 3603,
-     3605, 3596, 3606, 3594, 3608, 3609, 3613, 3611, 3612, 3617,
-     3625, 3626, 3622, 3624, 3628, 6159, 3623, 3630, 3631, 3634,
-     3635, 3640, 6159, 3637, 3641, 3644, 3649, 3647, 3653, 3651,
-     3660, 3661, 3663, 3664, 3665, 3666, 3668, 3675, 3672, 3671,
-     3674, 3678, 3680, 6159, 3681, 3685, 3689, 3692, 6159, 3694,
-     3703, 3704, 3705, 3695, 3706, 3700, 3713, 6159, 3708, 3710,
+     3514, 3526, 3527, 3528, 3529, 3535, 3536, 3539, 3541, 3530,
+     3545, 3552, 3534, 3542, 3557, 3554, 3565, 3561, 6299, 3566,
+     3562, 3573, 3547, 3568, 3570, 3574, 3576, 3578, 3575, 3579,
+     3582, 3585, 3592, 3587, 3588, 3589, 3597, 3593, 6299, 3604,
+     3602, 3605, 3610, 3611, 3618, 3614, 3595, 3617, 3620, 3622,
+     3624, 3627, 3628, 3629, 3632, 3633, 6299, 6299, 3635, 3636,
+     3637, 6299, 3640, 3639, 3651, 3642, 3643, 3644, 3655, 3654,
+     3652, 3656, 3658, 3665, 6299, 3666, 3673, 3668, 3669, 3680,
+     3683, 3686, 3670, 3682, 3672, 3679, 3687, 3690, 3689, 3694,
+     3695, 3703, 3706, 3701, 3702, 3704, 6299, 3705, 3709, 3710,
 
-     3715, 3716, 3723, 3718, 3725, 3722, 6159, 3724, 3726, 3728,
-     6159, 3729, 3730, 3738, 3743, 3735, 3750, 3746, 3748, 3751,
-     3747, 6159, 3749, 6159, 3758, 3759, 3762, 6159, 3760, 3764,
-     3765, 3767, 3768, 3769, 3773, 3780, 3775, 3781, 3782, 3783,
-     3784, 3786, 3793, 3785, 3789, 3792, 3794, 6159, 3804, 3796,
-     3797, 3811, 3809, 3801, 3799, 3817, 3815, 6159, 6159, 3824,
-     6159, 3826, 3819, 3821, 6159, 3825, 3827, 3836, 3831, 3832,
-     3842, 3839, 3843, 6159, 3846, 3849, 6159, 3847, 3858, 3854,
-     3855, 3856, 3859, 3860, 3862, 3864, 3865, 3863, 3867, 3866,
-     6159, 3870, 3871, 3879, 3869, 3873, 3888, 3892, 3880, 6159,
+     3712, 3713, 3714, 6299, 3716, 3718, 3727, 3719, 3737, 3726,
+     3723, 3741, 3738, 3742, 3743, 3744, 3745, 3746, 3753, 3748,
+     3750, 3752, 3757, 3760, 6299, 3761, 3767, 3754, 3769, 6299,
+     3772, 3781, 3779, 3782, 3777, 3784, 3785, 3792, 6299, 3787,
+     3790, 3788, 3791, 3801, 3793, 3802, 3804, 3798, 6299, 3805,
+     3806, 3807, 6299, 3808, 3813, 3819, 3821, 3822, 3829, 3824,
+     3826, 3827, 3828, 6299, 3834, 6299, 3832, 3836, 3840, 6299,
+     3838, 3843, 3844, 3846, 3847, 3852, 3853, 3851, 3860, 3861,
+     3862, 3864, 3865, 3863, 3868, 3872, 3869, 3870, 3874, 3875,
+     6299, 3876, 3878, 3885, 3890, 3897, 3886, 3893, 3880, 3899,
 
-     3894, 3884, 3895, 3896, 3898, 6159, 3902, 6159, 3903, 3906,
-     3904, 3907, 3908, 6159, 3910, 3914, 3918, 3919, 3920, 3922,
-     3926, 3929, 3923, 3930, 3938, 3935, 3933, 3936, 6159, 3937,
-     3939, 3943, 3947, 3949, 3951, 3958, 3954, 3955, 3960, 3961,
-     3963, 3967, 3965, 3972, 3974, 3970, 3968, 6159, 3976, 3980,
-     3981, 3990, 3987, 3991, 6159, 3992, 3993, 3994, 6159, 3995,
-     3997, 4000, 4006, 4001, 4007, 4010, 4013, 4014, 6159, 4011,
-     4012, 4015, 4016, 4028, 4022, 6159, 6159, 4030, 6159, 4032,
-     4018, 4037, 4039, 4020, 4034, 4047, 4042, 4054, 4040, 4044,
-     4050, 4056, 4064, 4066, 4067, 4062, 4068, 4070, 6159, 6159,
+     3900, 6299, 6299, 3903, 6299, 3906, 3907, 3908, 6299, 3910,
+     3912, 3917, 3914, 3915, 3918, 3922, 3919, 6299, 3929, 3932,
+     6299, 3930, 3940, 3935, 3937, 3938, 3943, 3939, 3941, 3945,
+     3949, 3951, 3946, 3950, 3947, 6299, 3954, 3952, 3956, 3960,
+     3967, 3968, 3970, 3969, 6299, 3976, 3977, 3973, 3980, 3983,
+     6299, 3984, 6299, 3982, 3986, 3992, 3994, 3988, 6299, 3997,
+     3998, 4002, 4003, 4005, 4006, 4009, 4011, 4013, 4015, 4023,
+     4019, 4020, 4018, 6299, 4021, 4022, 4028, 4037, 4030, 4032,
+     4047, 4034, 4042, 4025, 4046, 4049, 4051, 4055, 4057, 4050,
+     4060, 4053, 6299, 4061, 4064, 4067, 4075, 4068, 4072, 6299,
 
-     4072, 4073, 4075, 4078, 4079, 4081, 4082, 4089, 4086, 4094,
-     4097, 4087, 4104, 6159, 4101, 4102, 4103, 6159, 4085, 4106,
-     4108, 4109, 4112, 4114, 4113, 4115, 4116, 4118, 4120, 4123,
-     4126, 4125, 4128, 4133, 4134, 4137, 4136, 4138, 4144, 6159,
-     4139, 4146, 4148, 4150, 4151, 4152, 4155, 4157, 4158, 6159,
-     4159, 6159, 4164, 4160, 4161, 4181, 4182, 4170, 4172, 4178,
-     4187, 4190, 4193, 4184, 4194, 4195, 4197, 4201, 4198, 6159,
-     4205, 4202, 4204, 4208, 4212, 4214, 4215, 4217, 4218, 4226,
-     4223, 4227, 4229, 4231, 4219, 4235, 4237, 4221, 6159, 4241,
-     4243, 4239, 4248, 4245, 4162, 4249, 4253, 4256, 4257, 4250,
+     4078, 4076, 4080, 6299, 4079, 4082, 4086, 4094, 4083, 4087,
+     4091, 4089, 4096, 6299, 4097, 4098, 4099, 4108, 4112, 4106,
+     6299, 6299, 4114, 6299, 4116, 4100, 4121, 4124, 4104, 4118,
+     4126, 4128, 4131, 4132, 4134, 4135, 4139, 4141, 4149, 4150,
+     4153, 4154, 4156, 4145, 6299, 6299, 4159, 4160, 4146, 4167,
+     4168, 4162, 4170, 4177, 4173, 4179, 4182, 4184, 4191, 6299,
+     4172, 4183, 4190, 4187, 6299, 4192, 4193, 4195, 4196, 4197,
+     4201, 4199, 4200, 4204, 4205, 4213, 4206, 4208, 4216, 4214,
+     4222, 4224, 4225, 4226, 4228, 4230, 4233, 6299, 4234, 4235,
+     4237, 4238, 4239, 4243, 4245, 4246, 4247, 6299, 4249, 6299,
 
-     4259, 4261, 6159, 4262, 4264, 4266, 4267, 4273, 4270, 4274,
-     4268, 4275, 6159, 4285, 4277, 4286, 4280, 4288, 4291, 4292,
-     4295, 4298, 4299, 4302, 6159, 4300, 4303, 4310, 4304, 4311,
-     4313, 4314, 4316, 6159, 4321, 4323, 4317, 4331, 4327, 4336,
-     4333, 4335, 4337, 4339, 4341, 4345, 4346, 4347, 4349, 4343,
-     4359, 4366, 4361, 6159, 4350, 6159, 4363, 4367, 4375, 4373,
-     4364, 6159, 4371, 4376, 4378, 4379, 4380, 6159, 4381, 4383,
-     4385, 4390, 6159, 4388, 4396, 4395, 4397, 4404, 4405, 6159,
-     4408, 4410, 4411, 4418, 4420, 4422, 4417, 4423, 4425, 4419,
-     4426, 4427, 4435, 4430, 4434, 6159, 4432, 4438, 4443, 4446,
+     4252, 4251, 4253, 4260, 4267, 4270, 4269, 4271, 4274, 4275,
+     4278, 4280, 4281, 4284, 4288, 4283, 4291, 4293, 6299, 4294,
+     4286, 4300, 4301, 4303, 4305, 4307, 4309, 4310, 4312, 4314,
+     4316, 4318, 4323, 4319, 4315, 4325, 4327, 6299, 4330, 4332,
+     4334, 4337, 4338, 4341, 4340, 4344, 4349, 4342, 4350, 4351,
+     4355, 6299, 4352, 4357, 4358, 4359, 4367, 4362, 4364, 4368,
+     4371, 6299, 4375, 4376, 4377, 4378, 4379, 4382, 4385, 4387,
+     4389, 4391, 4399, 6299, 4394, 4390, 4403, 4401, 4405, 4404,
+     4407, 4409, 6299, 4410, 4416, 4413, 4420, 4422, 4429, 4427,
+     4431, 4424, 4433, 4434, 4430, 4438, 4441, 4442, 4440, 4458,
 
-     4440, 4447, 4448, 4454, 4450, 6159, 4455, 4456, 4457, 4458,
-     4461, 4459, 4464, 4468, 4474, 4466, 4470, 4473, 4471, 6159,
-     4475, 4481, 4488, 4485, 4494, 6159, 6159, 4483, 4498, 4487,
-     4495, 4500, 6159, 4502, 4509, 4504, 4508, 4505, 6159, 6159,
-     4511, 6159, 4512, 6159, 4513, 4515, 6159, 6159, 4517, 4518,
-     4519, 4520, 4529, 6159, 4533, 6159, 4540, 4535, 4523, 4526,
-     4537, 6159, 4538, 4541, 4546, 6159, 4543, 4555, 4547, 4551,
-     6159, 4559, 4560, 4550, 4554, 6159, 4561, 4568, 4570, 4556,
-     4564, 4571, 4577, 4578, 4580, 4581, 4582, 4583, 4584, 4586,
-     4591, 4596, 4598, 4588, 4599, 4601, 4604, 4607, 4602, 4609,
+     4459, 4444, 6299, 4445, 6299, 4455, 4456, 4466, 4461, 4463,
+     4467, 6299, 4469, 4472, 4474, 4471, 4475, 6299, 4478, 4476,
+     4479, 4481, 6299, 4477, 4491, 4482, 4483, 4498, 4499, 6299,
+     4504, 4505, 4501, 4513, 4515, 4510, 4512, 4514, 4516, 4518,
+     4520, 4521, 4522, 4531, 4524, 4527, 6299, 4529, 4536, 4542,
+     4543, 4545, 4526, 4537, 4546, 4552, 4547, 6299, 4549, 4553,
+     4555, 4556, 4558, 4559, 4561, 4569, 4565, 4564, 4567, 4572,
+     4568, 6299, 4576, 4574, 4578, 4587, 4584, 4591, 6299, 6299,
+     4580, 4595, 4597, 4585, 4598, 6299, 4601, 4608, 4603, 4607,
+     4604, 6299, 6299, 4610, 6299, 4612, 6299, 4614, 4616, 6299,
 
-     4610, 4611, 4613, 4615, 4619, 4623, 4620, 4616, 4625, 4624,
-     4626, 4633, 4629, 4635, 4640, 4641, 4637, 4642, 4643, 4644,
-     4645, 4647, 4651, 4652, 4654, 6159, 4653, 4657, 4658, 4661,
-     4666, 4665, 4672, 4674, 4676, 4682, 6159, 4684, 6159, 4686,
-     4678, 4688, 4689, 6159, 4690, 4691, 4692, 4693, 4694, 4695,
-     4698, 4697, 4701, 4702, 4704, 6159, 4707, 4711, 4712, 4723,
-     6159, 4716, 4727, 4718, 4724, 4728, 4729, 4730, 4731, 4734,
-     4732, 4738, 4740, 4741, 4746, 4754, 4761, 4745, 4743, 4747,
-     4757, 4756, 4760, 4764, 4765, 4771, 4772, 4778, 6159, 4768,
-     6159, 4773, 4775, 4779, 4781, 4783, 4784, 4786, 6159, 6159,
+     6299, 4617, 4618, 4619, 4620, 4627, 6299, 4634, 6299, 4629,
+     4635, 4621, 4631, 4638, 6299, 4639, 4640, 4642, 6299, 4645,
+     4655, 4646, 4647, 6299, 4651, 4656, 4648, 4657, 6299, 4660,
+     4666, 4663, 4669, 4670, 4671, 4672, 4677, 4678, 4673, 4681,
+     4680, 4683, 4690, 4694, 4696, 4698, 4699, 4684, 4701, 4703,
+     4707, 4705, 4709, 4710, 4712, 4714, 4715, 4719, 4723, 4716,
+     4720, 4724, 4725, 4726, 4733, 4729, 4735, 4740, 4736, 4741,
+     4742, 4743, 4744, 4747, 4748, 4750, 4754, 4757, 4758, 6299,
+     4752, 4753, 4759, 4766, 4764, 4771, 4774, 4781, 4784, 4785,
+     6299, 4787, 6299, 4789, 4777, 4791, 4792, 4793, 6299, 4794,
 
-     4789, 4790, 4796, 4785, 4792, 4798, 4799, 6159, 4802, 4807,
-     4813, 4806, 6159, 4808, 4814, 4815, 4821, 6159, 4816, 4818,
-     4822, 4825, 4829, 4831, 4832, 4833, 4836, 4838, 4840, 6159,
-     6159, 6159, 6159, 4843, 4841, 4846, 4847, 4849, 4855, 4856,
-     4854, 4851, 6159, 4858, 6159, 6159, 4867, 4868, 4861, 4869,
-     4870, 4871, 4876, 4879, 6159, 4877, 4881, 4883, 4880, 4894,
-     4897, 4882, 4898, 4884, 4891, 4905, 4901, 4907, 4900, 4911,
-     4913, 4918, 6159, 6159, 4910, 4920, 4921, 4928, 4925, 4926,
-     4935, 4932, 4933, 4934, 4937, 4939, 4940, 4948, 4950, 4941,
-     4945, 6159, 4949, 4953, 6159, 4951, 6159, 4955, 4959, 4958,
+     4797, 4796, 4799, 4798, 4800, 4801, 4804, 4805, 4809, 4812,
+     6299, 4817, 6299, 4806, 4821, 4826, 6299, 4822, 4833, 4829,
+     4834, 4835, 4836, 4837, 4838, 4841, 4839, 4844, 4846, 4848,
+     4853, 4850, 4861, 4868, 4854, 4863, 4864, 4865, 4867, 4869,
+     4871, 4873, 4880, 4882, 4886, 6299, 4874, 6299, 4881, 4877,
+     4888, 4891, 4892, 4894, 4898, 6299, 6299, 4895, 4899, 4904,
+     4901, 4905, 4907, 4908, 6299, 4909, 4918, 4920, 4913, 6299,
+     4910, 4921, 4927, 4929, 6299, 4930, 4931, 4932, 4934, 4935,
+     4938, 4939, 4943, 4945, 4946, 4949, 6299, 6299, 6299, 6299,
+     4950, 4953, 4956, 4957, 4959, 4960, 4962, 4964, 4965, 6299,
 
-     4962, 4965, 4968, 4966, 4969, 6159, 6159, 4979, 4980, 6159,
-     4970, 4971, 4981, 4983, 4984, 4985, 4972, 4993, 4988, 6159,
-     4990, 6159, 4995, 4997, 4999, 4996, 5008, 5010, 5012, 5014,
-     5009, 5011, 6159, 5018, 5019, 6159, 5020, 5022, 5023, 6159,
-     5025, 5028, 5030, 5034, 6159, 5040, 5031, 5037, 6159, 5044,
-     6159, 5041, 5045, 5047, 5054, 6159, 5049, 5051, 6159, 5056,
-     5058, 5060, 5062, 6159, 5064, 6159, 5065, 5067, 5070, 5073,
-     5068, 5077, 5074, 5078, 5079, 5086, 5089, 5090, 6159, 6159,
-     5098, 5081, 5091, 5095, 5099, 5106, 5084, 5103, 5102, 6159,
-     6159, 5108, 6159, 5110, 5114, 6159, 5112, 5116, 5121, 5120,
+     4967, 6299, 6299, 4968, 4974, 4976, 4977, 4978, 4981, 4983,
+     4985, 6299, 4984, 4989, 4991, 4987, 4998, 5004, 5006, 4988,
+     5007, 5001, 5008, 5015, 5011, 5013, 5010, 5017, 5021, 5024,
+     6299, 6299, 5018, 5028, 5029, 5036, 5033, 5034, 5037, 5046,
+     5041, 5042, 5043, 5044, 5048, 5049, 5060, 5061, 5053, 5050,
+     6299, 5063, 5064, 6299, 5057, 6299, 5066, 5072, 5065, 5073,
+     5075, 5076, 5078, 5080, 6299, 6299, 5087, 5082, 6299, 6299,
+     5074, 5090, 5092, 5095, 5096, 5091, 5097, 5099, 5101, 6299,
+     5102, 6299, 5103, 5104, 5106, 5107, 5119, 5122, 5124, 5126,
+     5121, 5109, 6299, 5127, 5128, 6299, 5130, 5131, 5133, 6299,
 
-     5122, 5123, 5127, 5129, 5130, 5131, 5132, 5126, 5147, 5154,
-     5133, 5136, 5149, 5156, 5158, 5160, 5151, 5163, 5162, 5164,
-     5165, 5166, 5169, 5172, 5173, 6159, 5175, 5176, 5170, 6159,
-     5181, 5187, 5186, 5191, 6159, 5198, 5195, 5199, 5200, 6159,
-     5183, 5203, 5206, 5205, 5207, 5217, 5212, 5215, 5219, 6159,
-     6159, 6159, 5213, 5221, 6159, 5227, 5228, 5229, 5230, 6159,
-     5231, 5177, 6159, 6159, 5232, 5234, 5233, 5241, 6159, 5237,
-     6159, 5238, 6159, 5239, 5245, 5246, 5251, 6159, 5256, 5262,
-     6159, 5265, 5268, 5270, 5271, 5252, 5236, 5273, 6159, 5281,
-     5274, 5277, 5284, 5258, 5285, 5286, 5287, 5294, 5289, 5293,
+     5137, 5135, 5140, 5143, 6299, 5147, 5150, 5144, 6299, 5152,
+     6299, 5155, 5156, 5157, 5164, 6299, 5159, 5165, 6299, 5168,
+     5171, 5173, 5172, 6299, 5160, 6299, 5162, 5181, 5183, 5187,
+     5174, 5191, 5188, 5177, 5192, 5199, 5197, 5194, 6299, 6299,
+      135, 5208, 5200, 5204, 5205, 5203, 5216, 5211, 5213, 5215,
+     6299, 6299, 5221, 6299, 5212, 5219, 6299, 5218, 5227, 5228,
+     5231, 5232, 5233, 5234, 5238, 5240, 5241, 5242, 5244, 5246,
+     5256, 5263, 5247, 5260, 5267, 5269, 5271, 5273, 5261, 5275,
+     5276, 5278, 5279, 5281, 5282, 5283, 5285, 6299, 5288, 5289,
+     5284, 6299, 5294, 5290, 5300, 5301, 6299, 5308, 5309, 5310,
 
-     6159, 5295, 5296, 5297, 5303, 5290, 5298, 5300, 6159, 5308,
-     6159, 5310, 5311, 5312, 5317, 5315, 5318, 5319, 5325, 5329,
-     5321, 5322, 5333, 5328, 6159, 5335, 5341, 6159, 5336, 6159,
-     5343, 6159, 5344, 5345, 5346, 5349, 6159, 5351, 5352, 5353,
-     5355, 6159, 5358, 5356, 5363, 5365, 6159, 6159, 5366, 5373,
-     5375, 5368, 5378, 5384, 5369, 5388, 5381, 5385, 5371, 5399,
-     5379, 5396, 5395, 5401, 5402, 5403, 6159, 6159, 6159, 5397,
-     5406, 5416, 5412, 5414, 5419, 5418, 6159, 5420, 5422, 5421,
-     5429, 5424, 5431, 6159, 5432, 5428, 5433, 5434, 5438, 5435,
-     5439, 6159, 5450, 5452, 5455, 5443, 5456, 5463, 5465, 5467,
+     5311, 6299, 5295, 5315, 5312, 5317, 5235, 5328, 5321, 5323,
+     5325, 6299, 6299, 6299, 5330, 5337, 6299, 5339, 5331, 5324,
+     5333, 6299, 5341, 5340, 6299, 6299, 5342, 5344, 5343, 5354,
+     6299, 5346, 6299, 5347, 6299, 5355, 5356, 5364, 5357, 6299,
+     5369, 5371, 6299, 5377, 5379, 5381, 5373, 5370, 5383, 5384,
+     6299, 5391, 5387, 5388, 5395, 5386, 5396, 5397, 5398, 5399,
+     5406, 5401, 5410, 6299, 5407, 5414, 5415, 5412, 5405, 5416,
+     5421, 6299, 5423, 6299, 5425, 5427, 5428, 5430, 5429, 5433,
+     5434, 5443, 5435, 5436, 5437, 5447, 5449, 6299, 5451, 5456,
+     6299, 5453, 6299, 5458, 6299, 5459, 5460, 5461, 5462, 6299,
 
-     5445, 5459, 5468, 6159, 5470, 6159, 6159, 5472, 6159, 5474,
-     5475, 5476, 5477, 6159, 5480, 5481, 5482, 5483, 5485, 5487,
-     6159, 5494, 5489, 5493, 5499, 6159, 6159, 5501, 6159, 5506,
-     5503, 5507, 5516, 5511, 5514, 5518, 5515, 6159, 5513, 5519,
-     5524, 5525, 5526, 6159, 5527, 5528, 5530, 5531, 5534, 5538,
-     5540, 5541, 5543, 6159, 5544, 5536, 5559, 5555, 6159, 5545,
-     5561, 6159, 6159, 5564, 5567, 5542, 6159, 6159, 6159, 5568,
-     5569, 5571, 6159, 5576, 5580, 5584, 5589, 5579, 6159, 5591,
-     5585, 5592, 6159, 6159, 5593, 5594, 5595, 5597, 6159, 6159,
-     5598, 5601, 5605, 5602, 5604, 6159, 5599, 5607, 5620, 5625,
+     5465, 5466, 5469, 5470, 6299, 5471, 5473, 5478, 5480, 6299,
+     6299, 5481, 5488, 5485, 5483, 5494, 5496, 5484, 5499, 5491,
+     5500, 5503, 5512, 5507, 5508, 5510, 5514, 5359, 5515, 6299,
+     6299, 6299, 5517, 5511, 5525, 5522, 5524, 5534, 5532, 6299,
+     5533, 5536, 5537, 5539, 5546, 5543, 5545, 6299, 5541, 5547,
+     5548, 5549, 5552, 5555, 5554, 6299, 5557, 5567, 5559, 5568,
+     5570, 5572, 5577, 5579, 5569, 5586, 5583, 6299, 5585, 6299,
+     6299, 5581, 6299, 5587, 5589, 5590, 5591, 6299, 5594, 5596,
+     5597, 5598, 5602, 5604, 6299, 5605, 5606, 5608, 5613, 6299,
+     6299, 5615, 6299, 5620, 5616, 5622, 5629, 5625, 5624, 5631,
 
-     5627, 5615, 5628, 5622, 5638, 5618, 5610, 5629, 5636, 5640,
-     5641, 5639, 5643, 5653, 5648, 5650, 5652, 5655, 6159, 6159,
-     5662, 5664, 5656, 6159, 6159, 5667, 5669, 5671, 5673, 5675,
-     5677, 5679, 6159, 5680, 5682, 5683, 5684, 5685, 6159, 5687,
-     5691, 5686, 5694, 5688, 5697, 5693, 5703, 6159, 6159, 5695,
-     5709, 5699, 5710, 5704, 6159, 5714, 5721, 5716, 5718, 5719,
-     5724, 5720, 6159, 5726, 5728, 6159, 6159, 5729, 6159, 6159,
-     5727, 6159, 6159, 6159, 6159, 6159, 6159, 6159, 5731, 6159,
-     5733, 5740, 5748, 5750, 6159, 5735, 5743, 5741, 5751, 5754,
-     6159, 5755, 5756, 5757, 5759, 5760, 5763, 5766, 5765, 5769,
+     5628, 6299, 5634, 5635, 5638, 5639, 5640, 6299, 5641, 5642,
+     5644, 5645, 6299, 5648, 5647, 5650, 5652, 5653, 6299, 5657,
+     5656, 5675, 5672, 6299, 5659, 5670, 6299, 6299, 5681, 5685,
+     5674, 6299, 6299, 6299, 5682, 5671, 5689, 6299, 5692, 5696,
+     5700, 5704, 5695, 6299, 5706, 5703, 5708, 6299, 6299, 5707,
+     5709, 5710, 5712, 6299, 6299, 5713, 5716, 5714, 5717, 5719,
+     6299, 5724, 5728, 5730, 5733, 5736, 5725, 5739, 5741, 5749,
+     5751, 5746, 5747, 5752, 5754, 5755, 5756, 5758, 5767, 5763,
+     5765, 5777, 5774, 6299, 6299, 5781, 5783, 5778, 6299, 6299,
+     5785, 5789, 5791, 5793, 5795, 5797, 5799, 6299, 5800, 5802,
 
-     5770, 5772, 5773, 5774, 5777, 5780, 5776, 5782, 5785, 6159,
-     6159, 6159, 5791, 5792, 5794, 5795, 5799, 5806, 5809, 5811,
-     5796, 5800, 5813, 5814, 5817, 5803, 5818, 5827, 5823, 5824,
-     5825, 5826, 5832, 5835, 5829, 5838, 5840, 6159, 5841, 6159,
-     5842, 6159, 6159, 5848, 5849, 5843, 5845, 5858, 5859, 5854,
-     5861, 5862, 5865, 5867, 5872, 6159, 6159, 5855, 5863, 6159,
-     5873, 5875, 6159, 5869, 5877, 5878, 5880, 5885, 5884, 5886,
-     5890, 5900, 6159, 6159, 5888, 5892, 5894, 5902, 5904, 5911,
-     5906, 5912, 5914, 5915, 5916, 5924, 6159, 5922, 5923, 5926,
-     6159, 5927, 5929, 5930, 5932, 5933, 5940, 5936, 5941, 6159,
+     5803, 5804, 5766, 6299, 5805, 5807, 5808, 5813, 5810, 5814,
+     5817, 5819, 6299, 6299, 5811, 5825, 5660, 5820, 5827, 6299,
+     5830, 5837, 5834, 5835, 5836, 5838, 5841, 6299, 5843, 5842,
+     6299, 6299, 5839, 6299, 6299, 5844, 6299, 6299, 6299, 6299,
+     6299, 6299, 6299, 5847, 6299, 5846, 5853, 5861, 5863, 6299,
+     5858, 5864, 5768, 5865, 5866, 6299, 5867, 5868, 5869, 5875,
+     5871, 5882, 5876, 5872, 5878, 5884, 5887, 5888, 5892, 5893,
+     5894, 5897, 5898, 5899, 6299, 6299, 6299, 5895, 5906, 5908,
+     5910, 5914, 5916, 5921, 5923, 5911, 5924, 5925, 5927, 5929,
+     5931, 5933, 5941, 5936, 5937, 5938, 5939, 5946, 5952, 5940,
 
-     5938, 6159, 5943, 5944, 5945, 5946, 5947, 5949, 5957, 5959,
-     5960, 6159, 5961, 5967, 5963, 5969, 5971, 5974, 5976, 5975,
-     5978, 5980, 5984, 5989, 5990, 5991, 5981, 5996, 5992, 6159,
-     6003, 5993, 6159, 5999, 6005, 5995, 6006, 6007, 6159, 6016,
-     6009, 6013, 6017, 6020, 6022, 6159, 6024, 6027, 6030, 6159,
-     6031, 6159, 6159, 6033, 6021, 6034, 6042, 6044, 6159, 6159,
-     6159, 6067, 6074, 6081, 6088, 6095,  218, 6102, 6109, 6116,
-     6123, 6130, 6137, 6144, 6151
+     5942, 5954, 6299, 5947, 6299, 5957, 6299, 6299, 5964, 5965,
+     5960, 5958, 5973, 5976, 5969, 5971, 5972, 5974, 5981, 5986,
+     6299, 6299, 5978, 5982, 6299, 5987, 5988, 6299, 5989, 5990,
+     5993, 5994, 5997, 5996, 5998, 6000, 6014, 6299, 6299, 6004,
+     6008, 6006, 6017, 6018, 6027, 6019, 6028, 6029, 6030, 6022,
+     6037, 6299, 6039, 6040, 6043, 6299, 6032, 6044, 6046, 6047,
+     6048, 6055, 6050, 6051, 6299, 6056, 6299, 6059, 6061, 6060,
+     6052, 6062, 6072, 6074, 6077, 6076, 6299, 6054, 6078, 6068,
+     6083, 6090, 6088, 6092, 6086, 6095, 6096, 6098, 6103, 6097,
+     6106, 6107, 6109, 6108, 6299, 6111, 6112, 6299, 6115, 6116,
+
+     6117, 6118, 6122, 6299, 6125, 6119, 6128, 6129, 6133, 6134,
+     6299, 6140, 6143, 6144, 6299, 6145, 6299, 6299, 6148, 6135,
+     6146, 6156, 6158, 6299, 6299, 6299, 6179, 6186, 6193, 6200,
+     6207, 6214, 6221,   88, 6228, 6235, 6242, 6249, 6256, 6263,
+     6270, 6277, 6284, 6291
     } ;
 
-static const flex_int16_t yy_def[3176] =
+static const flex_int16_t yy_def[3245] =
     {   0,
-     3161,    1, 3162, 3162, 3163, 3163, 3164, 3164, 3165, 3165,
-     3166, 3166, 3161, 3167, 3161, 3161, 3161, 3161, 3168, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3169, 3161, 3161, 3161, 3169, 3170, 3161, 3161,
-     3161, 3170, 3171, 3161, 3161, 3161, 3161, 3171, 3172, 3161,
-     3161, 3161, 3172, 3173, 3161, 3174, 3161, 3173, 3173, 3167,
-     3167, 3161, 3175, 3168, 3175, 3168, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3226,    1, 3227, 3227, 3228, 3228, 3229, 3229, 3230, 3230,
+     3231, 3231, 3232, 3232, 3233, 3233, 3226, 3234, 3226, 3226,
+     3226, 3226, 3235, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3236, 3226, 3226, 3226,
+     3236, 3237, 3226, 3226, 3226, 3237, 3238, 3226, 3226, 3226,
+     3226, 3238, 3239, 3226, 3226, 3226, 3239, 3240, 3226, 3241,
+     3226, 3240, 3240, 3242, 3226, 3226, 3226, 3226, 3242, 3243,
+     3226, 3226, 3226, 3243, 3234, 3234, 3226, 3244, 3235, 3244,
+     3235, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3169, 3169, 3170, 3170, 3171, 3171, 3161, 3172,
-     3172, 3173, 3173, 3174, 3174, 3173, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3236, 3236, 3237,
+     3237, 3238, 3238, 3226, 3239, 3239, 3240, 3240, 3241, 3241,
+     3240, 3242, 3242, 3226, 3243, 3243, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3173, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3240, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3173, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3240, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
-     3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226,
+     3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3161, 3167, 3173, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3226, 3234, 3240, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3173, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3240, 3234, 3234, 3234, 3234,
 
-     3167, 3161, 3167, 3161, 3161, 3167, 3161, 3161, 3167, 3167,
-     3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3234, 3226, 3226, 3234, 3226, 3226, 3234,
+     3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
 
-     3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3173, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3161, 3167, 3167, 3161, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3240, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3226, 3234, 3234, 3226, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3161, 3167, 3161, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3161, 3161, 3167, 3167, 3167, 3167,
-     3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234,
+     3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226,
+     3226, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167,
-     3173, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3240, 3240, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
 
-     3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167,
-     3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3240, 3234,
+     3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167,
-     3161, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3161, 3167,
-     3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3161, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3226, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3226,
+     3234, 3226, 3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3226, 3234, 3240, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234,
+     3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
-     3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3161,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167,
-     3167, 3167, 3161, 3167, 3161, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3226, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3226, 3226, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167,
+     3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3226,
+     3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3240, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3161, 3161, 3167, 3167, 3167,
-     3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167,
-     3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3161, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3226, 3226, 3234, 3234,
+     3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167,
-     3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3161, 3167, 3161, 3167, 3167, 3167, 3161, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3161, 3167,
-     3161, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3161, 3167, 3167, 3161, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3226,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3240, 3234, 3226, 3234,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3226, 3234, 3226, 3234, 3234, 3234, 3226,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3161, 3167, 3161, 3167, 3167,
-     3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167,
-     3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3161, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167,
-     3167, 3167, 3167, 3167, 3167, 3161, 3161, 3167, 3161, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3161,
+     3234, 3226, 3226, 3234, 3226, 3234, 3234, 3234, 3226, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234,
+     3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234,
+     3226, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3226, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3226,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3161, 3167, 3167, 3167, 3161, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
-     3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3226, 3226, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3240, 3234, 3234,
+     3234, 3234, 3234, 3234, 3226, 3226, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226,
+     3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3226,
 
-     3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3161, 3167, 3161, 3167, 3167, 3167, 3167,
-     3167, 3161, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167,
-     3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
-     3167, 3167, 3167, 3167, 3167, 3161, 3161, 3167, 3167, 3167,
-     3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3161, 3161,
-     3167, 3161, 3167, 3161, 3167, 3167, 3161, 3161, 3167, 3167,
-     3167, 3167, 3167, 3161, 3167, 3161, 3167, 3167, 3167, 3167,
-     3167, 3161, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167,
-     3161, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3234, 3226, 3234, 3226, 3234, 3234, 3234, 3234, 3240,
+     3234, 3226, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3226,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3226,
+     3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234,
+     3234, 3226, 3226, 3234, 3226, 3234, 3226, 3234, 3234, 3226,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3161, 3167,
-     3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167,
-     3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167,
-     3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3161,
+     3226, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3226, 3234,
+     3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3226, 3234,
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3226, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3240, 3234, 3234, 3234, 3234, 3226,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3226, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3226, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167,
-     3167, 3167, 3161, 3167, 3167, 3167, 3167, 3161, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
-     3161, 3161, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3161, 3167, 3161, 3161, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3161, 3161, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3161, 3167, 3167, 3161, 3167, 3161, 3167, 3167, 3167,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3226, 3234, 3226, 3234, 3234, 3234, 3226, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3226, 3234, 3226, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3226, 3226, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3226,
+     3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3226, 3226, 3226, 3226,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226,
 
-     3167, 3167, 3167, 3167, 3167, 3161, 3161, 3167, 3167, 3161,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
-     3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3161, 3167, 3167, 3161, 3167, 3167, 3167, 3161,
-     3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3161, 3167,
-     3161, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3161, 3167,
-     3167, 3167, 3167, 3161, 3167, 3161, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3161,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
-     3161, 3167, 3161, 3167, 3167, 3161, 3167, 3167, 3167, 3167,
+     3234, 3226, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3240, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3226, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3226, 3234, 3234, 3226, 3234, 3226, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3226, 3226, 3234, 3234, 3226, 3226,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226,
+     3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3226, 3234, 3234, 3234, 3226,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3161,
-     3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3161,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
-     3161, 3161, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3161,
-     3167, 3167, 3161, 3161, 3167, 3167, 3167, 3167, 3161, 3167,
-     3161, 3167, 3161, 3167, 3167, 3167, 3167, 3161, 3167, 3167,
-     3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3226, 3234,
+     3226, 3234, 3234, 3234, 3234, 3226, 3234, 3234, 3226, 3234,
+     3234, 3234, 3234, 3226, 3234, 3226, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3226,
+     3240, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3226, 3226, 3234, 3226, 3234, 3234, 3226, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234,
+     3234, 3226, 3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234,
 
-     3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167,
-     3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3161, 3167, 3167, 3161, 3167, 3161,
-     3167, 3161, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167,
-     3167, 3161, 3167, 3167, 3167, 3167, 3161, 3161, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3161, 3161, 3161, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167,
-     3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3226, 3226, 3226, 3234, 3234, 3226, 3234, 3234, 3234,
+     3234, 3226, 3234, 3234, 3226, 3226, 3234, 3234, 3234, 3234,
+     3226, 3234, 3226, 3234, 3226, 3234, 3234, 3234, 3234, 3226,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3226, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234,
+     3226, 3234, 3226, 3234, 3226, 3234, 3234, 3234, 3234, 3226,
 
-     3167, 3167, 3167, 3161, 3167, 3161, 3161, 3167, 3161, 3167,
-     3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167,
-     3161, 3167, 3167, 3167, 3167, 3161, 3161, 3167, 3161, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167,
-     3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3161, 3167,
-     3167, 3161, 3161, 3167, 3167, 3167, 3161, 3161, 3161, 3167,
-     3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3161, 3167,
-     3167, 3167, 3161, 3161, 3167, 3167, 3167, 3167, 3161, 3161,
-     3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167,
+     3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3226,
+     3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226,
+     3226, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3226,
+     3226, 3234, 3226, 3234, 3234, 3234, 3234, 3226, 3234, 3234,
+     3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3226,
+     3226, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3161,
-     3167, 3167, 3167, 3161, 3161, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3161, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3161, 3167,
-     3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3161, 3167, 3167, 3161, 3161, 3167, 3161, 3161,
-     3167, 3161, 3161, 3161, 3161, 3161, 3161, 3161, 3167, 3161,
-     3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167,
-     3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
+     3234, 3226, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234,
+     3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3226, 3234,
+     3234, 3234, 3234, 3226, 3234, 3234, 3226, 3226, 3234, 3234,
+     3234, 3226, 3226, 3226, 3234, 3234, 3234, 3226, 3234, 3234,
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3226, 3226, 3234,
+     3234, 3234, 3234, 3226, 3226, 3234, 3234, 3234, 3234, 3234,
+     3226, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3226, 3226, 3234, 3234, 3234, 3226, 3226,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234,
 
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
-     3161, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3161,
-     3167, 3161, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3161, 3161, 3167, 3167, 3161,
-     3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3161, 3161, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167,
-     3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3226, 3226, 3234, 3234, 3234, 3234, 3234, 3226,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234,
+     3226, 3226, 3234, 3226, 3226, 3234, 3226, 3226, 3226, 3226,
+     3226, 3226, 3226, 3234, 3226, 3234, 3234, 3234, 3234, 3226,
+     3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3226, 3226, 3226, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
 
-     3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3161, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167,
-     3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3167, 3161,
-     3167, 3167, 3161, 3167, 3167, 3167, 3167, 3167, 3161, 3167,
-     3167, 3167, 3167, 3167, 3167, 3161, 3167, 3167, 3167, 3161,
-     3167, 3161, 3161, 3167, 3167, 3167, 3167, 3167, 3161, 3161,
-        0, 3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161,
-     3161, 3161, 3161, 3161, 3161
+     3234, 3234, 3226, 3234, 3226, 3234, 3226, 3226, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3226, 3226, 3234, 3234, 3226, 3234, 3234, 3226, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3226, 3226, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3226, 3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3226, 3234, 3226, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3226, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234, 3234,
+     3234, 3234, 3234, 3234, 3226, 3234, 3234, 3226, 3234, 3234,
+
+     3234, 3234, 3234, 3226, 3234, 3234, 3234, 3234, 3234, 3234,
+     3226, 3234, 3234, 3234, 3226, 3234, 3226, 3226, 3234, 3234,
+     3234, 3234, 3234, 3226, 3226,    0, 3226, 3226, 3226, 3226,
+     3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226,
+     3226, 3226, 3226, 3226
     } ;
 
-static const flex_int16_t yy_nxt[6200] =
+static const flex_int16_t yy_nxt[6340] =
     {   0,
-       14,   15,   16,   17,   18,   19,   18,   14,   14,   14,
-       14,   14,   18,   20,   21,   22,   23,   24,   25,   26,
-       14,   27,   28,   29,   30,   31,   32,   33,   34,   35,
-       36,   37,   38,   39,   40,   41,   14,   14,   14,   42,
-       44,   45,   46,   44,   45,   46,   49,   50,   49,   50,
-       51,   47,   51,   70,   47,   70,   70,   52,   70,   52,
-       54,   55,   56,   57,   70,   18,   54,   55,   56,   57,
-       71,   18,   58,   60,   61,   62,   71,   82,   58,   60,
-       61,   62,   72,   71,   63,  104,   73,   93,   71,   71,
-       63,   15,   16,   17,   65,   66,   67,   75,   71,   75,
+       18,   19,   20,   21,   22,   23,   22,   18,   18,   18,
+       18,   18,   22,   24,   25,   26,   27,   28,   29,   30,
+       18,   31,   32,   33,   34,   35,   36,   37,   38,   39,
+       40,   41,   42,   43,   44,   45,   18,   18,   18,   46,
+       48,   49,   50,   48,   49,   50,   53,   54,   53,   54,
+       55,   51,   55,   85,   51,   85,   85,   56,   85,   56,
+       58,   59,   60,   61,   85,   22,   58,   59,   60,   61,
+       86,   22,   62,   64,   65,   66,   86,   97,   62,   64,
+       65,   66,   87,   86,   67,  119,   88,  108,   85,   86,
+       67,   19,   20,   21,   69,   70,   71,   75,   76,   77,
 
-       75,   71,   75,   68,  106,  159,  105,   94,   75,   76,
-       71,  359,   69,   15,   16,   17,   65,   66,   67,   71,
-       71,   83,   77,   78,  120,   68,   79,   71,   84,   71,
-       95,   80,   85,   72,   69,   86,   71,   73,   71,   97,
-       81,   71,  143,  143,   96,   71,   87,   98,  114,  100,
-       88,  142,  101,   89,  145,   90,   91,  145,   99,  102,
-       71,  103,   71,  107,   71,  111,   92,   71,  139,  112,
-       71,  108,  140,   71,   71,  121,  141,  109,  115,  122,
-      161,  110,  116,   71,  131,  113,  132,  888,  117,  123,
-      124,  118,  125,   71,   71,  133,  153,  135,  119,  126,
+       78,   86,   22,   72,  121,   86,  120,  109,   86,   79,
+      158,  158,   73,   19,   20,   21,   69,   70,   71,   75,
+       76,   77,   78,  185,   22,   72,   81,   82,   83,  129,
+       90,   79,   90,   90,   73,   90,   86,   84,   81,   82,
+       83,   90,   91,   86,   86,   98,   92,   93,  168,   84,
+       94,  157,   99,   86,  110,   95,  100,  160,   86,  101,
+      160,  168,   86,  112,   96,   86,  165,  165,  111,   86,
+      102,  113,  135,  115,  103,  171,  116,  104,   86,  105,
+      106,  177,  114,  117,  168,  118,   86,  122,   86,  126,
+      107,   86,  154,  127,  176,  123,  155,   86,   86,  136,
 
-       71,  134,  127,  147,  158,  147,  147,  136,  147,  128,
-      156,  137,  138,  129,  130,  150,  150,   75,   70,   75,
-       75,  152,   75,  152,  152,   70,  152,   70,   70,  155,
-       70,   71,   75,   71,   75,   75,   70,   75,   71,   71,
-       71,  157,  162,   75,   76,  160,   71,   71,   71,  163,
-       71,   71,   71,  173,  175,   71,  166,  168,  165,   71,
-       71,   71,  164,  169,  167,  170,  171,  172,   71,  177,
-       71,  174,   71,  176,   71,  178,   71,   71,  185,  179,
-       71,  180,  181,   71,  153,  187,  183,   71,  193,  182,
-      184,  188,   71,   71,   71,  189,  186,   71,  190,   71,
+      156,  124,  130,  137,   86,  125,  131,   86,  146,  128,
+      147,  179,  132,  138,  139,  133,  140,   86,   86,  148,
+       87,  150,  134,  141,   88,  149,  142,  162,   86,  162,
+      162,  151,  162,  143,  174,  152,  153,  144,  145,   90,
+      180,   90,   90,  167,   90,  167,  167,  172,  167,  172,
+      172,  170,  172,  175,  175,   85,   86,   85,   85,   90,
+       85,   90,   90,   86,   90,   86,   85,  178,  182,   86,
+       90,   91,  183,   86,   86,   86,  181,   86,   86,   86,
+      195,  188,  186,   86,   86,  184,   86,  189,  187,  190,
+       86,   86,   86,  173,   86,  191,  192,  197,  194,  196,
 
-       71,  203,  195,  198,  196,   71,  206,  199,   71,  204,
-       71,  191,  192,  194,   71,  205,  201,  207,   71,   71,
-       71,  202,   71,  200,  197,   71,  211,  208,   71,  216,
-       71,   71,   71,   71,   71,  213,   71,  210,  209,  214,
-      215,   71,   71,  212,  228,  218,   71,  221,  229,   71,
-       71,  217,  224,  223,  219,  227,   71,  230,   71,  222,
-      220,   71,  235,  225,   71,  233,   71,  226,   71,   71,
-      239,   71,   71,   71,  231,  153,  234,  232,  243,  240,
-      236,  242,  238,  244,   71,  237,   71,  143,  143,  246,
-      245,  241,  145,   71,  147,  145,  147,  147,  249,  147,
+      193,   86,  203,   86,  198,  200,  201,  205,   86,   86,
+      204,  199,   86,  202,  207,  209,   86,  213,  210,   86,
+       86,  206,  208,   86,  216,   86,   86,   86,   86,  218,
+       86,  211,  212,  219,  223,  215,   86,  225,  226,   86,
+      224,   86,  214,   86,  217,  911,  221,   86,  227,  220,
+       86,  222,  228,   86,  231,   86,   86,   86,  236,   86,
+      233,   86,   86,  229,  234,  230,  238,   86,  248,   86,
+       86,  232,   86,   86,   86,  239,  235,   86,   86,  237,
+      244,  240,  241,  247,  249,   86,  250,  242,  243,   86,
+       86,  245,  256,   86,  255,  246,  253,   86,   86,  259,
 
-      247,  150,  150,  152,   71,  152,  152,   75,  152,   75,
-       75,  153,   75,   71,  248,  250,   71,   71,   71,  155,
-       71,   71,  252,   71,  254,  257,   71,   71,  253,  256,
-      251,  255,  260,   71,  263,   71,   71,  267,  259,  258,
-       71,  264,  262,   71,  268,   71,  261,  269,  266,   71,
-       71,   71,  270,   71,   71,  277,   71,  272,   71,   71,
-      265,  280,  273,  278,  279,   71,  284,  274,   71,  271,
-      281,  282,   71,  275,  276,   71,   71,   71,  283,  286,
-       71,  287,   71,   71,  288,   71,   71,   71,  294,   71,
-       71,  289,  295,  304,  301,  285,  308,  290,  291,   71,
+       86,   86,   86,  251,   86,  263,  252,  254,  260,  258,
+      262,  257,   86,  264,  158,  158,  267,  266,  160,  168,
+      261,  160,  265,  162,  168,  162,  162,  268,  162,  165,
+      165,  167,   86,  167,  167,   90,  167,   90,   90,  172,
+       90,  172,  172,   86,  172,  175,  175,  170,  269,  270,
+      272,   86,   86,   86,   86,   86,   86,   86,   86,   86,
+      274,  277,   86,  280,  271,  276,  273,  275,   86,   86,
+      283,  282,  279,   86,  286,  278,   86,  284,  288,  281,
+       86,  287,   86,  289,   86,   86,  292,   86,  290,   86,
+      297,  293,  299,  285,   86,   86,  294,   86,  304,  298,
 
-      302,  292,   71,  293,   71,  296,  303,  306,  297,   71,
-      298,   71,  305,   71,  310,  311,   71,  314,   71,  307,
-       71,   71,  299,   71,  300,  318,   71,  316,  317,  309,
-      312,  315,   71,   71,   71,   71,   71,  313,   71,   71,
-       71,  320,   71,   71,  322,  319,   71,   71,  324,   71,
-       71,  326,  327,  331,   71,  325,  321,   71,  332,   71,
-       71,  323,  328,   71,  335,  329,   71,  337,  333,  340,
-      330,   71,  334,   71,   71,   71,   71,  346,   71,  336,
-      343,  342,   71,   71,  338,  339,  347,   71,  349,  345,
-       71,  341,   71,  344,   71,   71,   71,  352,  353,   71,
+      300,   86,  295,  296,   86,  291,  301,   86,   86,  302,
+       86,  306,   86,  307,  303,   86,   86,   86,   86,   86,
+       86,   86,   86,   86,  314,  315,  308,  305,  321,  309,
+      311,  310,  322,  312,  339,  313,   86,  316,  323,  324,
+      317,  326,  318,   86,  325,   86,  328,   86,   86,  330,
+       86,  331,   86,  327,  319,   86,  320,   86,  334,   86,
+       86,  336,   86,  337,   86,  335,  332,   86,  329,   86,
+       86,  333,   86,   86,   86,   86,   86,  338,  340,  341,
+      342,  344,   86,   86,  343,  347,   86,  346,  345,   86,
+      351,   86,   86,   86,  357,  352,   86,  353,  348,   86,
 
-      153,  354,  350,   71,  356,  357,  348,   71,   71,  351,
-       71,   71,  361,  360,   71,   71,   71,   71,  367,   71,
-      368,  365,  358,  363,   71,  355,   71,   71,   71,  371,
-      362,   71,  369,  370,  364,   71,   71,  374,   71,   71,
-      366,   71,  378,   71,   71,  380,  372,  376,   71,   71,
-      373,   71,  375,   71,  379,   71,  381,  382,   71,  384,
-       71,   71,  383,   71,  385,  386,  377,   71,  387,   71,
-      388,   71,   71,  389,   71,  393,  392,  394,  397,  396,
-      390,  391,   71,   71,   71,   71,  395,   71,  399,   71,
-      401,  402,   71,   71,  400,  398,   71,   71,   71,   71,
+       86,   86,  349,  355,  360,   86,   86,   86,  363,  350,
+       86,  354,  362,  356,   86,   86,   86,  366,  367,  358,
+      359,  369,  365,   86,   86,  361,   86,   86,   86,   86,
+      372,  373,   86,  364,  374,  368,   86,  376,  370,  168,
+       86,   86,  371,   86,   86,   86,  377,   86,   86,   86,
+      380,  381,   86,   86,  385,  383,  387,  166,  375,  379,
+      382,  388,   86,  378,   86,   86,  391,   86,  384,  389,
+      390,   86,   86,   86,   86,  386,   86,   86,  397,   86,
+       86,  400,  398,  399,   86,  396,  392,  393,   86,   86,
+      395,   86,  394,   86,  401,  402,   86,  404,   86,   86,
 
-       71,   71,  408,   71,   71,   71,  409,   71,  411,   71,
-      414,  405,  404,  407,   71,   71,  403,  410,  416,  406,
-      419,   71,   71,   71,  412,  413,   71,   71,   71,  151,
-      420,   71,  415,  418,  421,  417,   71,  428,   71,   71,
-       71,  429,  431,  430,  432,  422,   71,  532,  423,  434,
-       71,   71,  436,  424,  425,  426,  427,   71,   71,   71,
-      433,  437,  438,  435,  439,   71,  444,  445,  441,  440,
-       71,   71,  447,   71,  442,   71,   71,  443,   71,  449,
-      446,  448,   71,   71,   71,   71,   71,  451,  456,   71,
-      450,   71,  474,   71,   71,  452,   71,  457,  461,  458,
+      405,   86,  403,   86,  408,  406,  407,  409,   86,   86,
+      412,   86,   86,  414,  415,  416,   86,  410,  411,   86,
+       86,   86,   86,  419,  417,  413,   86,  421,  422,   86,
+       86,  420,   86,   86,   86,   86,   86,  428,   86,   86,
+       86,  418,  429,   86,   86,  427,   86,  431,  425,  424,
+       86,  434,   86,  423,   86,  436,  426,  432,  430,  439,
+       86,   86,  433,  440,  435,   86,  438,   86,   86,   86,
+       86,  454,  437,  441,   86,  450,  448,   86,   86,  164,
+      451,   86,  452,  442,   86,   86,  443,  449,  461,  163,
+      456,  444,  445,  446,  447,   86,  464,  455,  453,   86,
 
-      462,  455,   71,  453,   71,  454,   71,  463,  459,  460,
-       71,   71,  149,   71,  466,  464,  467,   71,  468,  475,
-      469,  465,  473,  476,   71,   71,   71,   71,   71,   71,
-      153,  477,   71,  470,   71,  478,  471,   71,  472,   71,
-       71,  479,  493,  148,  490,  480,   71,  488,  492,  489,
-       71,  508,  491,  481,   71,  482,  505,  483,  494,   71,
-      495,  506,   71,   71,   71,  503,  514,   71,  504,  507,
-      484,   71,   71,  485,   71,  486,   71,  487,   71,   71,
-      496,  497,  510,  509,   71,  511,  522,  146,  516,  513,
-      498,  512,  499,  500,  501,   71,  517,  502,   71,  515,
+      459,  457,  458,   86,   86,  460,   86,   86,  467,   86,
+       86,  469,  462,  465,   86,  463,  466,   86,  470,  468,
+       86,   86,  471,   86,   86,  476,   86,  477,   86,  478,
+       86,   86,  472,   86,  494,  481,  482,   86,  479,  475,
+      473,   86,   86,  474,   86,   86,  483,   86,  480,  484,
+      486,  488,  487,   86,  493,  485,  489,  495,  496,   86,
+       86,   86,   86,   86,   86,  497,   86,  498,  161,  490,
+       86,  168,  491,  499,  492,   86,   86,  500,   86,   86,
+      512,  508,  513,  509,  515,  501,   86,  502,   86,  503,
+      510,  511,  528,  523,  525,   86,   86,  524,  514,  526,
 
-       71,   71,   71,   71,  525,   71,  518,  519,  523,   71,
-       71,   71,  526,   71,   71,   71,  524,  530,  520,   71,
-      521,  528,   71,   71,  533,  527,   71,  529,  534,  535,
-       71,   71,   71,   71,  540,  536,   71,  543,  537,  531,
-      544,   71,  538,  541,  539,   71,  546,   71,   71,   71,
-       71,   71,  560,   71,   71,  545,  565,  144,   71,  562,
-      552,  542,   71,  548,   71,  549,  547,  551,  550,  555,
-       71,  553,   71,  554,   71,   71,  563,  556,  557,  561,
-       71,  558,  559,  564,   71,   71,  567,   71,  568,   71,
-      569,   71,  572,   71,  570,   71,  566,  574,   71,   71,
+       86,  527,  504,   86,   86,  505,   86,  506,   86,  507,
+       86,   86,  516,  517,  533,  529,   86,  531,  530,   86,
+       86,   86,  518,  532,  519,  520,  521,  537,   86,  522,
+      536,  535,  534,   86,   86,   86,   86,  538,  545,   86,
+      543,  540,  539,   86,   86,   86,  546,   86,  541,  542,
+      550,  544,   86,   86,   86,  548,   86,   86,   86,  547,
+       86,  549,  553,  554,  555,   86,   86,   86,   86,  552,
+      560,  564,  559,   86,  556,   86,  557,  551,   86,  565,
+       86,  558,  561,  562,   86,  567,   86,   86,   86,   86,
+      581,   86,  568,  569,  566,  584,   86,  573,   86,   86,
 
-      575,   71,  577,  578,   71,  571,  573,   71,  579,   71,
-       71,   71,  576,   71,   71,  584,  582,   71,  583,   71,
-       71,   71,  580,  585,   71,   71,   71,  590,   71,  586,
-      591,  581,   71,  589,   71,  593,   71,  592,  588,  587,
-       71,  594,   71,  596,   71,  598,   71,   71,   71,  595,
-       71,   71,   71,   71,  597,  600,   71,  601,  608,   71,
-       71,  599,  603,  615,   71,  609,  602,  607,  610,  604,
-       71,  605,  606,  612,   71,  611,   71,   71,   71,  618,
-       71,   71,  621,   71,  613,   71,  620,  614,   71,   71,
-       71,  616,   71,  617,  624,  623,   71,   71,   71,   71,
+      563,   86,  570,  572,  576,  571,  583,  582,  574,   86,
+      575,   86,  577,  578,  586,   86,  579,  580,  585,   86,
+       86,  588,   86,  589,   86,  590,   86,   86,  593,  591,
+       86,   86,  587,  595,   86,   86,  596,   86,  598,  599,
+       86,   86,   86,  594,  600,   86,  592,   86,  597,   86,
+       86,  605,  603,   86,  604,   86,  601,   86,   86,  606,
+       86,   86,   86,  602,  611,  607,  612,   86,  614,  610,
+       86,   86,  613,   86,   86,  608,  609,   86,  615,   86,
+      617,   86,  619,   86,   86,  621,   86,   86,   86,   86,
+      629,  616,  622,  618,  631,  620,   86,   86,  624,   86,
 
-      619,  627,   71,  628,  630,   71,  622,   71,   71,   71,
-      661,  629,  625,  626,   71,   71,   71,   71,  631,  644,
-      633,   71,   71,   71,  632,   71,  634,  647,  642,  643,
-       71,  635,  650,  636,  665,  645,   71,  646,   71,  637,
-       71,  638,   71,  648,  639,  640,  652,  649,   71,  653,
-       71,  641,  655,  651,   71,   71,  657,  658,   71,  654,
-       71,  662,   71,  656,   71,  659,   71,  663,   71,   71,
-       71,   71,   71,   71,  669,  660,   71,  664,  673,  666,
-      670,   71,  668,   71,   71,  674,  153,  667,  672,  671,
-      675,  676,   71,  677,   71,   71,   71,   71,  678,   71,
+       86,  159,   86,  628,  623,  625,  630,  626,  627,   86,
+       86,   86,   86,  633,  632,  636,  637,  639,  634,   86,
+       86,  635,   86,   86,  642,  641,  638,   86,   86,   86,
+       86,   86,  645,  648,  644,   86,   86,   86,   86,  640,
+      649,   86,  651,   86,   86,   86,   86,   86,  643,  665,
+      646,  650,  647,   86,  652,   86,  654,   86,   86,  668,
+      653,   86,  655,  667,  663,  666,   86,  656,  664,  657,
+       86,  672,  671,   86,   86,  658,   86,  659,  669,  676,
+      660,  661,  670,  675,   86,   86,  673,  662,   86,  674,
+      677,  679,  678,   86,   86,  682,   86,   86,  684,   86,
 
-      683,   71,   71,  679,  685,   71,  680,   71,  688,  681,
-      687,   71,  684,  682,   71,  686,  690,  689,   71,   71,
-       71,   71,   71,  692,   71,   71,   71,   71,  696,  695,
-      691,   71,  701,  693,  153,  697,  694,  702,   71,  704,
-       71,   71,  698,  700,  703,  699,  705,   71,  706,  707,
-       71,  708,   71,  709,   71,  710,   71,   71,   71,   71,
-      711,   71,  712,   71,   71,  716,  713,   71,   71,  714,
-      717,   71,   71,  718,  722,  715,  721,   71,   71,   71,
-       71,  719,  723,   71,  725,   71,  727,   71,   71,   71,
-      720,   71,   71,  733,  730,  724,   71,  726,   71,   71,
+       86,   86,   86,   86,   86,   86,   86,  680,   86,  690,
+       86,   86,  686,  681,  685,  691,  687,  694,   86,  695,
+      693,  683,  688,   86,  689,  168,  697,  692,   86,  696,
+      698,   86,   86,   86,   86,   86,   86,   86,  699,  704,
+       86,  743,  706,   86,  709,  701,   86,  700,  702,  705,
+       86,  707,  703,  708,   86,  711,   86,   86,  710,   86,
+      713,   86,   86,   86,   86,   86,  717,   86,  712,  716,
+      722,   86,   86,  714,  718,  723,   86,  715,  725,   86,
+      770,  719,  727,  721,  720,  724,  726,   86,   86,  728,
+       86,  729,   86,  730,   86,  731,   86,   86,   86,   86,
 
-       71,  734,  728,   71,   71,  740,  736,  731,   71,  729,
-       71,  737,  732,   71,  735,  738,  739,   71,   71,   71,
-       71,  747,  743,  744,  745,  752,  741,   71,   71,  742,
-       71,   71,   71,  749,  746,  750,   71,  748,   71,  753,
-       71,   71,   71,  754,   71,   71,  761,   71,  755,  757,
-      759,   71,   71,   71,  758,   71,   71,  751,  756,  151,
-      762,   71,  767,   71,  760,  765,   71,  766,   71,  764,
-       71,  763,  768,  769,  770,  771,   71,   71,   71,  772,
-       71,  774,  776,  773,   71,  778,  803,   71,   71,  777,
-      779,   71,   71,  781,  775,   71,   71,  780,  782,   71,
+      732,   86,   86,  736,   86,  735,   86,   86,  734,  739,
+       86,  744,  738,   86,   86,  733,  737,   86,  740,   86,
+       86,   86,   86,  745,   86,  747,   86,  749,   86,  742,
+      741,   86,  746,  752,   86,  748,  755,  750,   86,   86,
+       86,   86,   86,  756,  176,  751,   86,  753,   86,   86,
+      762,  758,   86,  757,  754,   86,  759,  765,  761,  763,
+      760,   86,  764,   86,  769,   86,  766,   86,  771,  767,
+       86,  772,   86,   86,   86,   86,  775,  774,  768,  776,
+       86,   86,   86,   86,   86,  783,   86,   86,  779,  781,
+       86,  777,   86,  773,  789,  780,  784,   86,  778,   86,
 
-       71,  788,   71,   71,   71,  785,   71,   71,  783,  784,
-       71,  791,  790,   71,  793,   71,  797,  794,  795,  786,
-      787,  789,   71,   71,  792,   71,  800,   71,  802,   71,
-      799,  801,   71,  796,   71,  798,  804,   71,   71,  806,
-       71,   71,   71,   71,  812,   71,   71,   71,  805,  813,
-       71,   71,   71,   71,   71,  814,  807,   71,  808,  809,
-       71,  810,  815,  811,   71,  821,  816,   71,  822,  819,
-      817,   71,  818,   71,   71,  820,  823,   71,  826,   71,
-       71,   71,   71,   71,   71,   71,  824,   71,  833,   71,
-      835,  836,  825,   71,   71,  827,  828,  829,  834,  830,
+       86,   86,   86,  782,   86,  791,  787,  790,  786,  785,
+       86,  788,  792,  793,   86,   86,   86,  794,   86,  798,
+      800,  795,  796,  799,  797,   86,   86,   86,   86,  803,
+      801,   86,   86,  802,  804,   86,   86,  810,   86,   86,
+       86,  807,   86,   86,  805,  806,   86,  813,  812,   86,
+      815,   86,  819,  816,  817,  808,  809,  811,   86,   86,
+      814,   86,  822,   86,  824,   86,  821,  823,   86,  818,
+       86,  820,  826,   86,   86,   86,  828,   86,   86,   86,
+       86,  834,   86,   86,   86,   86,  835,   86,   86,   86,
+      825,   86,  827,  829,  836,  830,  831,   86,  832,  837,
 
-      831,  832,   71,   71,  837,  838,   71,  839,  840,   71,
-       71,   71,   71,   71,   71,   71,  845,  844,  841,  846,
-      847,   71,  843,   71,   71,  842,  848,   71,  852,   71,
-      850,  849,  153,  851,   71,   71,  853,  855,  856,   71,
-       71,  854,   71,  857,   71,   71,  863,   71,  858,  859,
-       71,  864,  866,   71,   71,   71,  869,  860,  861,  865,
-       71,   71,   71,  867,   71,  871,  862,   71,   71,  875,
-       71,   71,   71,   71,  868,   71,  872,   71,  876,  877,
-      870,   71,   71,   71,   71,   71,  874,   71,  908,  878,
-      890,  889,  873,  891,   71,  894,  887,  880,  879,   71,
+      833,  839,   86,  838,  843,   86,  842,   86,  840,  841,
+       86,   86,   86,   86,   86,   86,  844,  845,  848,   86,
+       86,   86,   86,   86,  857,   86,  846,  855,  850,  858,
+      847,  849,   86,  851,   86,  856,   86,  852,  853,  854,
+       86,   86,   86,   86,   86,  860,  862,   86,  867,   86,
+      861,  859,   86,   86,  866,   86,  863,  865,  869,  868,
+      870,  864,   86,   86,   86,   86,  168,  871,   86,  872,
+       86,  877,  873,  878,  875,   86,   86,   86,  874,  879,
+      876,   86,   86,   86,  885,   86,  881,  888,   86,   86,
+      880,   86,  886,   86,   86,  891,  882,  883,  889,   86,
 
-       71,  892,   71,   71,  881,   71,  893,  900,  882,   71,
-      895,  883,   71,   71,  896,   71,   71,   71,  884,  885,
-      899,  886,   71,  897,   71,   71,  898,   71,  901,  902,
-      914,  903,   71,   71,  904,  910,  909,  911,   71,  905,
-      912,  915,  913,  919,   71,  906,  907,  916,   71,  917,
-       71,  918,   71,  921,   71,   71,  923,  920,   71,   71,
-       71,   71,  925,  924,   71,  926,  927,   71,   71,  922,
-      928,   71,   71,  929,   71,  931,   71,   71,  935,   71,
-       71,   71,   71,  930,  934,   71,  938,   71,  944,   71,
-      942,  149,  932,  933,  936,  937,   71,   71,  939,  940,
+      887,   86,   86,  884,   86,   86,  893,  897,   86,   86,
+       86,  894,  890,   86,  892,   86,  898,  899,   86,   86,
+       86,   86,   86,  896,   86,   86,  913,  900,  914,  895,
+      912,   86,   86,  915,  910,   86,  917,   86,  902,  922,
+      901,   86,  174,  903,   86,  918,  904,  916,   86,  919,
+      905,   86,   86,  906,   86,  921,  933,   86,  924,  932,
+      907,  908,  920,  909,   86,   86,   86,   86,   86,   86,
+      935,  937,  923,   86,  925,  926,  967,  927,   86,   86,
+      928,  936,   86,  934,  938,  929,   86,  939,   86,  942,
+      943,  930,  931,  940,  941,  944,   86,   86,   86,  946,
 
-      945,  948,  943,   71,  941,  946,   71,   71,  947,  949,
-       71,   71,  951,  952,   71,   71,  950,   71,   71,   71,
-      953,  955,   71,  956,   71,  954,   71,  957,   71,   71,
-       71,  962,   71,  959,   71,  965,  960,   71,   71,   71,
-       71,   71,   71,  963,  958,  964,   71,   71,  967,  961,
-       71,  968,  970,  972,   71,  971,   71,  966,   71,  973,
-       71,   71,  978,   71,  969,   71,  980,  979,   71,  976,
-      974,   71,   71,   71,  977,   71,   71,  987,  981,  985,
-       71,  983,   71,  975,  988,   71,   71,  986,   71,   71,
-      982,  990,   71,   71,   71,   71,   71,  984,   71,   71,
+       86,  948,   86,  947,  945,   86,   86,  949,  950,  952,
+       86,  951,   86,   86,  953,   86,   86,   86,   86,   86,
+      956,   86,  960,   86,   86,  954,  959,   86,   86,  963,
+       86,   86,  969,   86,  955,  965,   86,  957,  958,  961,
+       86,  962,   86,  985,  970,  968,  973,  972,  964,  971,
+       86,  974,   86,  966,   86,  976,   86,   86,   86,  975,
+       86,   86,  978,  977,  980,   86,  979,  981,   86,   86,
+       86,   86,   86,  987,   86,   86,  984,  982,   86,  990,
+       86,   86,   86,   86,  988,   86,  989,   86,  983,   86,
+      992,  986,  993,   86,  995,   86,  996,   86,  997,  991,
 
-      998,  989,   71,  991,  996, 1001,   71,   71,  992,  993,
-       71,   71,   71,  995,  994, 1002,  999,  997, 1000, 1003,
-       71, 1004,   71,   71, 1005,   71, 1006,   71, 1008, 1009,
-       71,   71, 1010,   71, 1011,   71, 1007,   71,   71, 1013,
-     1018,   71, 1019, 1021,   71, 1023,   71, 1012,   71,   71,
-       71,   71,  148, 1014, 1024, 1020, 1016, 1015, 1017,   71,
-       71,   71,   71, 1025, 1022,   71, 1032, 1029,   71, 1026,
-       71, 1031,   71, 1027,   71,   71,   71, 1033, 1036, 1038,
-       71, 1028,   71,   71,   71,   71, 1030,   71, 1037, 1035,
-     1040, 1041,  153, 1034,   71,   71,   71, 1044, 1042, 1043,
+       86,   86,  998,   86,   86, 1005,  994,  999, 1003,   86,
+     1001,   86,   86, 1004,   86,   86, 1002,   86, 1013,   86,
+     1010, 1008,   86,   86, 1006, 1000,   86,   86, 1011, 1012,
+     1007, 1015,   86,   86,   86,   86,   86,   86,   86, 1009,
+       86, 1026, 1023, 1014, 1016, 1021,   86,   86,   86,   86,
+       86,  173, 1017, 1018,   86, 1020, 1019, 1027, 1024,   86,
+     1022, 1028,   86,   86,   86, 1025,   86, 1033, 1030, 1029,
+     1031, 1034,   86, 1032,   86, 1036,   86,   86,   86,   86,
+     1043,   86, 1044, 1035, 1038,   86,   86, 1046,   86,   86,
+     1048,   86,   86,   86, 1037, 1050,   86, 1039, 1041, 1045,
 
-     1039,   71,   71,   71,   71,   71, 1047,   71,   71, 1045,
-       71, 1059, 1060,  146, 1046,   71, 1062,   71, 1050,   71,
-       71, 1048,   71,  144, 1064, 1051,   71, 1049, 1052,   71,
-     1061, 1067, 1053,   71, 1054,   71, 1069, 1065, 1055,   71,
-     1056, 1070,   71,   71, 1063, 1057,   71, 1066,   71, 1068,
-     1058, 1075, 1072, 1071,   71,   71,   71,   71, 1074,   71,
-     1078, 1076,   71,   71, 1073,   71, 1077, 1087, 1084, 1083,
-     1079, 1082,   71, 1081,   71, 1085, 1086,   71, 1080, 1088,
-       71,   71,   71,   71,   71,   71,   71, 1089,   71, 1100,
-       71,   71, 1103, 1104,   71, 1099,   71,   71, 1102, 1090,
+     1040, 1042, 1049,   86,   86,   86,   86, 1056,   86, 1047,
+     1054, 1051, 1057,   86,   86, 1052, 1058,   86,   86,   86,
+     1061, 1063,   86, 1053,   86, 1055,   86,   86,   86, 1066,
+     1060,   86, 1059, 1065, 1067,  168,   86,   86, 1070, 1062,
+     1069,   86, 1064,   86,   86,   86, 1068,   86, 1073, 1071,
+       86,   86,   86, 1085,   86,   86, 1088,   86, 1086,   86,
+       86, 1072,   86, 1074, 1076,   86, 1090, 1077,   86, 1075,
+     1087, 1147, 1078,   86, 1091,   86, 1079,   86, 1080, 1092,
+     1093, 1095, 1081,   86, 1082, 1089, 1096,   86,   86, 1083,
+       86, 1094, 1097,   86, 1084,   86,   86, 1099,   86,   86,
 
-     1091,   71, 1092,   71, 1101, 1105,   71, 1093, 1106, 1094,
-     1110,   71, 1109,   71,   71, 1095,   71,   71, 1111,   71,
-     1096, 1097, 1107, 1115,   71, 1108,   71, 1098,   71, 1112,
-     1113, 1117, 1116,   71, 1121, 1114, 1118,   71, 1119, 1120,
-       71,   71,   71,   71,   71, 1127, 1122,   71,   71,   71,
-       71,   71, 1124, 1125,   71, 1130,   71, 1128,   71,   71,
-       71, 1123,   71, 1126,   71,   71,   71,   71, 1129, 1135,
-     1132, 1134, 1137, 1136, 1131, 1139,   71,   71, 1133, 1138,
-       71,   71,   71, 1140,   71, 1142,   71,   71,   71,   71,
-     1141, 1147, 1148, 1149, 1144,   71, 1143, 1152, 1150, 1146,
+     1102,   86, 1098, 1105,   86, 1101,   86,   86, 1104, 1100,
+     1103,   86, 1111, 1106, 1112, 1109, 1115, 1110, 1108, 1113,
+       86,   86, 1107, 1114,   86,   86, 1116,   86,   86,   86,
+       86,   86,   86,   86,   86, 1131, 1128,   86,   86,   86,
+       86, 1127, 1132,   86,   86, 1130,   86, 1118, 1119, 1117,
+       86, 1120, 1129, 1134, 1133, 1138, 1121,   86, 1122, 1135,
+     1137,   86, 1136,   86, 1123,   86,   86,   86, 1139, 1124,
+     1125, 1143,   86,   86, 1146, 1140, 1126, 1144,   86,   86,
+       86, 1141, 1150,   86, 1142,   86,   86, 1145,   86,   86,
+     1151,   86, 1149, 1156,   86, 1153,   86, 1148, 1154,   86,
 
-     1145,   71, 1151,   71,   71, 1155,   71,   71, 1153, 1159,
-     1156,   71,   71, 1157,   71,   71, 1158,   71,   71,   71,
-     1154, 1160, 1166,   71, 1168,   71,   71,   71,   71, 1172,
-       71, 1162, 1164, 1165, 1161, 1163,   71,   71,   71,   71,
-     1169, 1170,   71, 1167, 1174,   71,   71, 1175, 1173,   71,
-     1177, 1171,   71,   71, 1176, 1180,   71, 1178, 1179, 1183,
-     1184,   71, 1182,   71,   71,   71,   71,   71,   71, 1181,
-     1187,   71, 1185,   71, 1188,   71,   71, 1194, 1192, 1195,
-       71,   71, 1186,   71, 1189,   71, 1196, 1190,   71, 1193,
-       71, 1191, 1199, 1197,   71, 1198, 1202,   71,   71,   71,
+       86,   86, 1152, 1157,   86, 1159,   86, 1155,   86,   86,
+       86,   86,   86,   86,   86, 1158,   86, 1166, 1161, 1164,
+     1163, 1160, 1165,   86, 1168, 1169, 1162,   86, 1170, 1167,
+       86,   86,   86,   86,   86,   86, 1171,   86, 1176, 1177,
+     1178, 1173, 1172,   86, 1180, 1181, 1179, 1175,   86, 1174,
+       86,   86, 1184,   86,   86,   86, 1186, 1185,   86, 1187,
+       86, 1182,   86, 1188,   86,   86, 1183, 1189,   86, 1195,
+       86, 1197,   86,   86, 1190,   86, 1201,   86, 1191,   86,
+     1194, 1193, 1192,   86, 1199,   86,   86, 1198,   86,   86,
+     1196, 1203,   86, 1204,   86,   86,   86, 1200,   86, 1206,
 
-     1201,   71,   71,   71, 1203, 1204,   71,   71,   71,   71,
-     1205, 1209, 1200,   71,   71, 1207, 1206, 1210,   71,   71,
-     1211, 1215, 1208, 1216,   71, 1219,   71,   71,   71,   71,
-     1213, 1212,   71, 1218,   71,   71, 1223,   71, 1214, 1217,
-       71,   71,   71,   71,   71, 1229,   71, 1222, 1221,   71,
-     1225, 1220,   71,   71,   71, 1224, 1235,   71,   71, 1233,
-       71, 1226,   71, 1228, 1231, 1232, 1230, 1234, 1227, 1237,
-     1238,   71,   71, 1240,   71,   71,   71, 1239,   71, 1241,
-     1236,   71,   71,   71,   71,   71,   71, 1244,   71, 1250,
-       71,   71, 1242, 1247,   71, 1243,   71,   71, 1245,   71,
+     1207,   86, 1209, 1212, 1208, 1205, 1202, 1211,   86,   86,
+     1213,   86,   86,   86, 1210,   86, 1216, 1214,   86, 1217,
+       86,   86,   86,   86,   86, 1221, 1223,   86, 1224, 1225,
+     1215,   86,   86, 1218,   86,   86, 1222,   86, 1228, 1219,
+     1226, 1220, 1227, 1231,   86, 1229,   86,   86,   86,   86,
+       86, 1230, 1232, 1233,   86, 1234,   86, 1235,   86,   86,
+       86, 1238, 1239,   86,   86,   86, 1244, 1245, 1236,   86,
+       86, 1240,   86,   86, 1247, 1237, 1242, 1248,   86,   86,
+       86, 1241, 1252,   86, 1243, 1246,   86,   86,   86,   86,
+       86,   86, 1258,   86, 1250, 1251,  168, 1254, 1249,   86,
 
-     1248,   71,   71, 1246, 1256, 1251, 1261, 1249, 1254,   71,
-     1260, 1253, 1252, 1257,   71, 1258,   71, 1255, 1259, 1262,
-       71, 1263,   71,   71,   71, 1265,   71,   71,   71,   71,
-     1264,   71, 1269, 1268,   71,   71, 1272, 1275,   71,   71,
-     3161, 1271, 1266,   71, 1267, 1273,   71, 1270, 1276,   71,
-       71, 1277,   71, 1280, 1274, 1279,   71,   71,   71, 1278,
-       71, 1281,   71,   71,   71,   71,   71,   71,   71,   71,
-     1287, 1282, 1283,   71, 1285, 1286, 1288, 1284,   71, 1292,
-       71,   71,   71, 1293, 1289, 1291,   71, 1290,   71, 1294,
-     1296,   71,   71, 1303,   71, 1297,   71,   71, 1295,   71,
+       86,   86,   86, 1265,   86, 1253, 1263,   86, 1255,   86,
+     1257,  168, 1262, 1260, 1267, 1256, 1259, 1261, 1264, 1268,
+       86,   86,   86,   86, 1270,   86, 1269, 1266, 1271,   86,
+       86,   86,   86,   86,   86,   86, 1274,   86, 1280,   86,
+       86, 1277,   86, 1272, 1273,   86,   86, 1275,   86,  166,
+     1278, 1284, 1276,   86, 1281,   86, 1279,   86, 1286, 1290,
+     1282, 1283,   86, 1291, 1294,   86,   86, 1287, 1285, 1288,
+     1292,   86, 1289, 1293,   86,   86,   86,   86, 1296,   86,
+     1295,   86,   86,   86, 1300,   86, 1299, 1303,   86,   86,
+     1297,   86, 1307,   86, 1298, 1302,   86,   86,   86, 1304,
 
-     1299, 1298,   71,   71, 1305,   71, 1301, 1307, 1304,   71,
-     3161, 1300, 1302, 1309,   71, 1308,   71, 1306, 1310,   71,
-       71, 1314,   71, 1312, 1311,   71, 1323, 1313,   71, 1321,
-     1325, 1322,   71, 1315,   71, 1324, 1316, 1317, 1327,   71,
-       71, 1318,   71, 1330,   71, 1328,   71, 1319, 1326,   71,
-       71, 1320,   71, 1332, 1329,   71,   71,   71, 1333,   71,
-     1334,   71,   71,   71,   71, 1342, 1337, 1331, 1339, 1344,
-     1335,   71, 1343,   71, 1336, 1340,   71, 1345,   71, 1338,
-     1341,   71, 1351, 1352, 1353, 1346,   71,   71,   71,   71,
-     1347,   71, 1348, 1355, 1349,   71, 1350,   71, 1354,   71,
+     1301, 1308, 1305, 1309,   86,   86, 1313, 1306, 1312, 1310,
+     1311,   86,   86,   86,   86,   86,   86,   86,   86,   86,
+       86,   86, 1319,   86,   86,   86, 1314, 1315, 1317, 1318,
+     1320, 1324, 1316,   86,   86,   86, 1321,   86, 1323, 1325,
+     1322, 1326, 1328, 1327,   86,   86,   86, 1335,   86, 1329,
+       86,   86,   86,   86, 1330,   86, 1331,   86,   86, 1338,
+     1333,   86, 1332, 1336, 1337,   86, 1334, 1341, 1342,   86,
+     1340, 1346, 1339, 1343,   86, 1345, 1344,   86, 1347,   86,
+       86,   86, 1354,   86, 1348, 1356, 1358, 1349, 1350, 1355,
+       86,   86, 1351,   86, 1357, 1360,   86, 1363, 1352, 1359,
 
-     1359,   71,   71, 1356, 1358, 1360,   71, 1363, 1361, 1357,
-       71,   71,   71,   71,   71, 1364, 1369,   71, 1370, 1362,
-     1365,   71,   71,   71,   71,   71, 1373, 1368, 1372, 1366,
-       71, 1367, 1371,   71, 1375,   71,   71, 1374, 1379,   71,
-     1378, 1381,   71,   71,   71, 1382,   71, 1383, 1376,   71,
-       71, 1380, 1387,   71, 1384,   71, 1389,   71, 1377, 1386,
-       71, 1390,   71,   71,   71, 1385,   71, 1391, 1394,   71,
-       71,   71,   71, 1396,   71, 1388,   71, 1398, 1400,   71,
-       71, 3161,   71, 1399, 1392, 1393, 1395,   71,   71,   71,
-     1402, 1397,   71, 1404, 1406, 1403, 1405, 1401,   71,   71,
+       86,   86, 1353,   86, 1364, 1361,   86, 1365, 1362,   86,
+       86,   86, 1366,   86, 1367,   86,   86,   86,   86, 1375,
+     1376, 1372, 1370,   86,   86,   86,   86, 1416, 1377, 1369,
+     1368, 1373,   86,   86,   86, 1371, 1374, 1378,   86, 1384,
+       86, 1379, 1385, 1386,   86,   86, 1380,   86, 1381,   86,
+     1382, 1387, 1383, 1388,   86, 1392, 1395,   86,   86, 1389,
+     1393,   86,   86, 1391,   86, 1390, 1394, 1396,   86,   86,
+       86, 1402, 1397, 1398,   86, 1403,   86,   86,   86,   86,
+       86,   86,   86,   86, 1401, 1406, 1404, 1399, 1400,   86,
+     1405, 1408,   86, 1407, 1411, 1412,   86, 1414,   86, 1409,
 
-     1407,   71, 1410, 1408, 1409,   71,   71,   71,   71,   71,
-     1411, 1416, 1417, 1413,   71, 1414,   71,   71,   71, 1418,
-     1419,   71, 1415,   71, 1412, 1420,   71, 1423,   71,   71,
-       71,   71, 1427, 1428, 1422,   71, 1430,   71,   71,   71,
-     1421, 1429,   71,   71,   71,   71,   71,   71, 1437, 1424,
-     1425, 1431,   71,   71, 1426,   71, 1434, 1432,   71, 1435,
-       71, 1442,   71, 1433, 1436, 1441,   71,   71,   71, 1446,
-       71, 1444, 1438, 1440, 1447,   71,   71, 1449, 1439,   71,
-       71, 1443,   71,   71, 1450, 1457, 1445,   71, 1448,   71,
-       71,   71, 1459, 1451, 1460, 1452, 1455, 1453,   71, 1456,
+       86,   86, 1415,   86,   86,   86, 1417, 1413, 1410, 1420,
+       86, 1422,   86, 1419,   86, 1423,   86,   86,   86, 1427,
+       86, 1424, 1418,   86,   86, 1421,   86, 1429,   86,   86,
+       86,   86, 1433, 1431,   86,   86,   86, 1435, 1425, 1426,
+     1432, 1437,   86, 1428,   86,   86, 1430, 1434,   86, 1439,
+     1436,   86,   86, 1440,   86, 1495, 1438, 1441,   86, 1442,
+       86, 1443,   86, 1444,   86,   86, 1445, 1449, 1446, 1450,
+     1452, 1447,   86,   86,   86,   86,   86, 1451, 1448,   86,
+       86, 1456,   86, 1453,   86,  168,   86,   86, 1461, 1462,
+       86, 1455,   86, 1464,   86,   86, 1463,   86, 1454,   86,
 
-     1454, 1458,   71, 1462,   71,   71,   71,   71, 1463,   71,
-     1467,   71, 1468, 1461,   71, 1465,   71,   71,   71, 1470,
-       71,   71, 1476, 1464, 1466,   71, 1475,   71,   71, 1469,
-       71, 1472,   71,   71, 1479,   71, 1471,   71, 1473, 1474,
-       71,   71, 1480,   71,   71, 1477,   71, 1478, 1483, 1482,
-       71, 1481, 1484, 1487,   71, 1486,   71,   71, 1491, 1488,
-     1485, 1489,   71,   71, 1494, 1490,   71, 1495, 1496,   71,
-     1498,   71, 1493,   71,   71,   71,   71, 1492, 1502, 1499,
-     1503, 1501,   71, 1497,   71,   71,   71,   71, 1504,   71,
-     1505, 1506,   71,   71, 1508,   71, 1500, 1507,   71,   71,
+     1458,   86,   86,   86, 1457,   86, 1459,   86, 1471,   86,
+     1460, 1465, 1467, 1468,   86,   86, 1469, 1466, 1476,   86,
+     1475, 1470,   86,   86,   86, 1472,   86,   86, 1478,   86,
+     1480,   86, 1474,   86, 1473, 1481,   86,   86, 1483, 1484,
+       86, 1485,   86, 1479, 1482, 1477,   86, 1489, 1486, 1491,
+     1490,   86, 1487, 1492,   86, 1488, 1494,   86, 1497,   86,
+     1493,   86,   86, 1498,   86, 1496,   86,   86,   86,   86,
+       86, 1502, 1503,   86,   86, 1506, 1499,   86,   86, 1501,
+       86, 1511,   86,   86,   86, 1500, 1504, 1512, 1508, 1505,
+       86, 1515,   86, 1507,   86, 1509, 1510,   86,   86,   86,
 
-     1509,   71, 1513,   71,   71,   71, 1512,   71,   71, 1510,
-     1516, 1519, 1515, 1511, 1521,   71, 1520,   71,   71, 1522,
-       71, 1517,   71, 1514,   71, 1524,   71, 1518,   71,   71,
-       71, 1528,   71,   71, 1532, 1523, 1535, 1525, 1527,   71,
-       71, 1526,   71,   71, 1533,   71,   71, 1529, 1538,   71,
-     1530, 1531, 1537,   71,   71,   71,   71,   71, 1534,   71,
-       71, 3161, 1536,   71, 1539,   71, 1546, 1552, 1540,   71,
-     1543, 1548, 1541,   71, 1542, 1545, 1547,   71, 1544, 1549,
-       71, 1550,   71,   71,   71,   71,   71, 1559, 1551,   71,
-     1553, 1556,   71, 1554,   71, 1557,   71, 1560, 1555, 1564,
+     1513,   86, 1516, 1514,   86,   86,   86,   86, 1518, 1522,
+       86, 1517, 1523, 1519, 1520, 1524, 1526,   86, 1527,   86,
+     1521,   86,   86, 1532, 1525,   86, 1531,   86,   86,   86,
+     1529, 1534,   86,   86, 1528,   86,   86, 1541,   86, 1535,
+     1539, 1533, 1530, 1538, 1536, 1540,   86,   86, 1542, 1543,
+       86,   86,   86,   86,   86,   86, 1537, 1544,   86,   86,
+       86, 1545,   86, 1550,   86,   86, 1549,   86,   86, 1547,
+     1553, 1556, 1546, 1548,   86, 1552, 1557,   86, 1554, 1558,
+     1551,   86, 1561,   86, 1559,   86,   86, 1555,   86,   86,
+       86,   86,   86, 1569, 1560, 1565,   86, 1564,   86,   86,
 
-       71, 1561,   71, 1566,   71,   71,   71, 1565, 1558,   71,
-       71, 1569, 1563,   71, 1562,   71,   71, 1570, 1568, 1567,
-     1571,   71, 1575, 1576,   71,   71,   71,   71,   71,   71,
-     1572, 1581, 1579, 1573,   71, 1580,   71,   71, 1583,   71,
-       71, 1574,   71, 1577,   71, 1584,   71, 1578,   71, 1582,
-     1585,   71, 1586,   71,   71, 1590, 1587, 1588,   71, 1591,
-       71,   71,   71, 1592, 1589,   71, 1595,   71, 1597,   71,
-       71,   71,   71, 1602, 1593,   71, 1596,   71, 1598, 1594,
-       71,   71,   71, 1599, 1608, 1600, 1605, 1607,   71, 1603,
-       71,   71, 1610,   71,   71, 1604, 1601, 1606,   71,   71,
+     1572, 1570, 1562,   86,   86, 1563,   86,   86, 1566, 1575,
+     1568, 1567,   86, 1574,   86,   86,   86,   86,   86,   86,
+       86, 1583, 1573, 1576, 1571,   86,  164,   86, 1584, 1586,
+       86, 1577, 1580, 1578, 1582, 1579, 1587,   86, 1581, 1585,
+       86,   86,   86,   86,   86, 1588, 1589,   86,   86, 1593,
+       86,   86, 1591, 1594, 1590,   86, 1597, 1592,   86, 1601,
+       86,   86,   86, 1598, 1603,   86, 1595, 1602, 1596,   86,
+       86,   86,   86, 1607, 1600, 1599, 1604, 1606, 1605,   86,
+       86,   86, 1612, 1608, 1613,   86,   86,   86,   86,   86,
+     1618, 1609,   86, 1617, 1616,   86,   86,   86, 1610, 1620,
 
-       71,   71, 1613, 1616,   71, 1612, 1615,   71,   71,   71,
-     1609,   71,   71, 1623, 1618, 1611,   71,   71, 1614,   71,
-       71, 1624,   71, 1621,   71, 1617,   71, 1619, 1620, 1627,
-       71, 1628, 1630,   71, 1632, 1634, 1622, 1625, 1631, 1626,
-       71,   71, 1629,   71, 1633, 1636,   71,   71,   71,   71,
-       71,   71, 1641,   71, 1638, 1639,   71, 1635,   71, 1642,
-       71,   71,   71, 1647, 1646,   71, 1637, 1643,   71, 3161,
-       71,   71, 1653, 1640, 1644, 1645,   71, 1648,   71, 1650,
-       71,   71, 1651,   71, 1655, 1654,   71,   71, 1649, 1669,
-     1660, 1658, 1657, 1662, 1652, 1659, 1661,   71,   71,   71,
+       86, 1611,   86,   86, 1614, 1621, 1622,   86, 1615,   86,
+       86,   86, 1625, 1623,   86, 1619,   86, 1628,   86, 1624,
+     1627,   86,   86,   86,   86, 1634,   86, 1632,   86, 1629,
+     1626,   86,   86,   86, 1639, 1635,   86, 1633,   86, 1630,
+     1631,   86,   86, 1642, 1644,   86, 1636, 1637,   86,   86,
+     1640,   86, 1645,   86, 1647,   86, 1638, 1643,   86, 1641,
+       86,  168, 1650,   86, 1653,   86, 1649,   86, 1652, 1646,
+       86,   86,   86, 1648,   86,   86, 1661, 1654,   86, 1651,
+       86,   86,   86, 1662, 1656, 1655, 1659,   86,   86, 1670,
+     1657, 1658,   86, 1666, 1668,   86, 1665,   86,   86, 1660,
 
-     1656,   71, 1664, 1663,   71, 1665, 1666,   71,   71,   71,
-       71,   71,   71, 1667, 1672, 1673, 1674,   71,   71, 1676,
-     1668,   71,   71, 1675,   71,   71, 1679,   71, 1670, 1678,
-     1671,   71,   71,   71,   71,   71, 1680,   71,   71,   71,
-     1677,   71,   71,   71, 1689,   71,   71,   71,   71, 1684,
-     1681, 1685, 1686, 1682, 1683, 1693,   71, 1687, 1691,   71,
-     1692,   71, 1690, 1698,   71, 1694, 1688,   71, 1695,   71,
-     1696,   71, 1701,   71, 1700,   71,   71,   71,   71,   71,
-     1697,   71,   71,   71,   71, 3161, 1708, 1699, 1702, 1703,
-     1706, 1709,   71, 1707, 1710, 1705, 1716,   71,   71, 1711,
+     1663, 1664, 1667, 1669, 1672,   86, 1674,   86,   86,   86,
+       86,   86,   86,   86, 1679, 1676, 1677, 1671,   86, 1673,
+       86, 1680,   86,   86,   86,   86,   86, 1675, 1684,   86,
+     1685,   86, 1681, 1692,   86,   86, 1678, 1694, 1683,   86,
+     1682,   86, 1686, 1687, 1689,   86, 1688, 1690,   86,   86,
+     1693,   86,   86, 1695, 1697, 1699, 1703, 1696, 1701, 1691,
+     1698, 1700,   86, 1702,   86,   86, 1704,   86, 1705,   86,
+     1706,   86,   86,   86,   86,   86,   86, 1707,   86, 1713,
+     1714, 1712,   86, 1716, 1708,   86,   86, 1715,   86,   86,
+       86, 1709,   86, 1710,   86, 1711,   86, 1718, 1719,   86,
 
-     1704, 1715, 1717,   71,   71,   71,   71, 1712,   71, 1714,
-       71, 1720, 1713, 1721,   71,   71, 1718,   71,   71, 1722,
-     1724,   71, 1725, 1719,   71,   71,   71,   71, 1733, 1723,
-     1728, 1734,   71,   71,   71, 1730, 1732, 1726, 1731,   71,
-     1727,   71,   71,   71, 1729,   71,   71,   71,   71, 1743,
-       71,   71, 1736, 1735,   71, 1740, 1738,   71,   71, 1737,
-     1745, 1739, 1746,   71, 1747, 1742, 1744, 1749,   71,   71,
-     1750, 1741, 1752, 1751,   71, 1755,   71,   71, 1748,   71,
-     1756,   71,   71, 1761,   71, 1763,   71, 1760,   71,   71,
-     1753, 1757, 1754, 1764, 1758,   71,   71, 1766, 1759,   71,
+       86, 1720,   86,   86,   86,   86,   86,   86, 1721, 1729,
+       86, 1717,   86,   86, 1722,   86, 1724, 1725, 1726,   86,
+     1723, 1734,   86, 1727, 1731, 1732,   86,   86, 1733, 1730,
+       86, 1728, 1739,   86,   86,   86,   86,   86, 1742, 1735,
+     1737, 1741, 1736,   86,   86,   86,   86,   86,   86,   86,
+     1743, 1738,   86,   86, 1740, 1747, 1749, 1744,   86,   86,
+     1759, 1750, 1748, 1746, 1751, 1757,   86,   86, 1745, 1752,
+     1756, 1758,   86, 1753,   86,   86,   86,   86, 1754, 1761,
+     1762,   86,   86,   86, 1755,   86,   86, 1765, 1763,   86,
+     1766,   86, 1760, 1774,   86, 1769, 1764,   86,   86,   86,
 
-     1765,   71, 1762,   71,   71, 1770,   71, 1767, 1768, 1772,
-     1769,   71, 1774,   71,   71, 1773,   71, 1771,   71,   71,
-       71, 1775, 1786,   71,   71,   71,   71, 1778,   71, 1779,
-     1784,   71, 1787, 1776,   71, 1777, 1780, 1781,   71, 1782,
-     1783, 1789,   71,   71,   71,   71,   71, 1788, 1794,   71,
-       71,   71, 1785,   71,   71, 1798,   71,   71,   71, 1793,
-       71, 1800, 1791, 1790, 1792, 1801, 1796,   71,   71, 1797,
-       71, 1795, 1802, 1799,   71, 1803,   71, 1804, 1807,   71,
-       71, 1805,   71, 1811,   71,   71,   71,   71,   71, 1806,
-       71,   71, 1809, 1813,   71, 1808,   71, 1818,   71, 1812,
+     1775,   86, 1767, 1771,   86, 1768, 1772, 1773,   86,   86,
+     1770,   86,   86,   86,   86,   86, 1784, 1776,   86,   86,
+       86, 1777, 1778, 1779, 1781, 1787,   86, 1780, 1786,   86,
+     1788,   86, 1783,   86, 1785,   86,   86,   86, 1782,   86,
+     1790, 1792,   86, 1791, 1789,   86,   86, 1794,  163, 1796,
+     1801, 1793, 1799, 1795, 1797,   86, 1798, 1802, 1804,   86,
+     1805, 1800,   86,   86, 1803, 1807,   86, 1806,   86,   86,
+       86,   86, 1811,   86, 1808, 1815,   86,   86,   86, 1813,
+       86,   86,   86,   86, 1810, 1814, 1812,   86, 1816, 1809,
+       86, 1819,   86,   86,   86,   86, 1817, 1825,   86, 1820,
 
-     1814, 1810, 1815,   71, 1821,   71, 1816, 1830, 1819, 1822,
-       71, 1817, 1820,   71, 1824,   71, 1823,   71,   71, 1827,
-     1828,   71, 1825,   71,   71,   71,   71, 1826,   71, 1831,
-       71,   71,   71,   71,   71, 1829,   71, 1836,   71,   71,
-       71, 1849, 1837, 1840, 1832,   71, 1838,   71, 1834, 1835,
-     1833, 1839,   71,   71, 1841, 1847,   71, 1844, 1846, 1843,
-     1848,   71,   71,   71, 1845,   71,   71, 1842, 1854,   71,
-       71,   71, 1857, 1858,   71, 1859,   71, 1850,   71, 1852,
-       71, 1851, 1861,   71, 1855, 1853, 1856,   71, 1862, 1860,
-     1865,   71,   71,   71, 1867,   71, 1866, 1869, 1868, 1863,
+     1821, 1818,   86, 1827, 1828, 1822,   86, 1823, 1824,   86,
+       86, 1830,   86, 1832,   86, 1829,   86, 1835,   86, 1826,
+       86,   86,   86,   86, 1839,   86, 1831,   86,   86, 1834,
+       86, 1841,   86, 1833,  168, 1842, 1837, 1843,   86, 1838,
+     1836,   86, 1840, 1844,   86,   86, 1847, 1849,   86,   86,
+     1845, 1846,   86, 1853,   86,   86,   86,   86,   86, 1848,
+       86, 1851,   86, 1855, 1850,   86,   86, 1860,   86, 1854,
+     1856, 1852, 1857,   86, 1863,  161, 1858, 1861, 1864,   86,
+       86,   86, 1859, 1865, 1862, 1866,   86,   86, 1869,   86,
+     1868,   86, 1867, 1872,   86, 1870,   86,   86,   86,   86,
 
-       71, 1864, 1871,   71,   71,   71,   71,   71,   71, 1873,
-       71, 1870, 1874,   71,   71, 1876, 1877,   71, 1881, 1879,
-       71, 1880,   71,   71,   71, 1875,   71, 1888, 1878, 1872,
-       71,   71, 1890,   71, 1882, 1883, 1884, 1891,   71,   71,
-       71, 1885, 1893, 1886,   71, 1892, 1887, 1896,   71,   71,
-     1889,   71,   71,   71, 1895, 1894,   71, 1897, 1900,   71,
-       71, 1902,   71,   71, 1905, 1906,   71,   71,   71, 1898,
-     1908,   71, 1899,   71,   71,   71, 1903,   71, 1901, 1913,
-     1914,   71, 1910, 1911, 1904,   71,   71, 1907,   71,   71,
-       71,   71, 1920, 1909,   71, 1917, 1912,   71, 1915, 1918,
+     1873, 1871,   86,   86,   86,   86,   86,   86, 1878,   86,
+     1879,   86,   86,   86,   86, 1880, 1883,   86, 1874, 1881,
+     1876, 1875, 1877, 1884, 1882,   86,   86,   86, 1890, 1892,
+     1887, 1889, 1886, 1891,   86,   86, 1885, 1888, 1893,   86,
+       86,   86,   86,   86, 1898,  159, 1894,   86,   86,   86,
+     1901, 1902,   86, 1903,   86,   86, 1896, 1905,   86, 1895,
+       86, 1897, 1899, 1904, 1900,   86, 1906,   86, 1907, 1909,
+       86, 1910, 1911, 1913,   86,   86, 1908, 1912,   86,   86,
+     1915,   86, 1918,   86, 1917, 1916,   86,   86,   86,   86,
+     1921,   86,   86, 1914, 1920,   86, 1924, 1923,   86, 1926,
 
-       71, 1916, 1924,   71,   71, 1923, 1927,   71,   71,   71,
-     1928, 1926,   71, 1922, 1930, 1919,   71, 1929,   71,   71,
-     1921,   71,   71, 1925,   71,   71,   71, 1932, 1931, 1935,
-       71, 1938, 1939, 1940, 1934,   71,   71,   71,   71,   71,
-     1933,   71, 1936,   71,   71, 1943, 1948,   71,   71, 1947,
-       71, 1937, 1942,   71,   71, 1941, 1945,   71, 1952, 1955,
-       71, 1944,   71, 1953,   71, 1946,   71, 1949, 1950, 1951,
-     1956, 1954, 1959,   71,   71, 1957,   71,   71,   71,   71,
-     1958,   71, 1966, 1963,   71,   71, 1969,   71,   71, 1968,
-     1961,   71, 1970,   71,   71, 1960, 1962, 1971,   71, 1964,
+       86,   86,   86, 1925, 1933,   86,   86, 1919,   86, 1922,
+       86, 1935, 1927, 1928, 1929,   86, 1936,   86,   86, 1930,
+     1938, 1931, 1932,   86,   86, 1941, 1934,   86, 1943, 1937,
+       86,   86, 1945,   86, 1939,   86, 1942,   86, 1947, 1940,
+       86,   86,   86, 1950, 1951,   86,   86, 1953,   86,   86,
+       86, 1944,   86,   86, 1959,   86,   86,   86, 1958, 1955,
+     1948, 1946, 1956, 1949,   86,   86, 1952,   86,   86,   86,
+     1965,   86, 1961, 1957, 1954, 1962, 1963, 1960,   86,   86,
+     1969,   86,   86,   86, 1968,   86,   86, 1972, 1975, 1971,
+     1973, 1964,   86,   86, 1967,   86,   86, 1966, 1974,   86,
 
-     1967, 1965,   71, 1972, 1976,   71, 1977,   71,   71, 1973,
-     1978, 1980, 1981,   71, 1974, 1979,   71,   71,   71,   71,
-     1985,   71, 1975,   71, 1983, 1984,   71, 1987,   71,   71,
-     1990,   71, 1992, 1986, 1982,   71,   71,   71,   71,   71,
-     1988,   71,   71,   71, 1998, 1997, 1996, 1993,   71, 1994,
-     1999,   71, 3161, 1991, 1989, 2000,   71, 2002, 1995,   71,
-       71,   71,   71,   71,   71, 2003, 2004, 2007, 2001, 2006,
-     2005,   71,   71,   71, 2008,   71, 2010,   71,   71, 2014,
-       71,   71,   71, 2013, 2009, 2011,   71, 2016,   71, 2012,
-     2015, 2017, 2018,   71,   71,   71,   71,   71,   71,   71,
+       86, 1970,   86,   86, 1976, 1977, 1980,   86,   86, 1983,
+     1984, 1978, 1979, 1985,   86,   86,   86,   86,   86,   86,
+     1981, 1988,   86,   86, 1993,   86,   86,   86, 1992,   86,
+     1987,   86,   86, 1982, 1986, 1997,   86, 1989, 1990,   86,
+       86, 1999, 1995, 2001, 1991, 1994, 1998, 2002, 1996, 2000,
+       86,   86, 2003, 2004,   86,   86,   86,   86,   86,   86,
+     2011,   86, 2008,   86, 2014,   86,   86,   86, 2013, 2006,
+       86, 2015, 2005,   86,   86, 2007, 2012, 2016, 2009, 2010,
+       86, 2021,   86, 2017, 2022,   86, 2025, 2020, 2023, 2026,
+       86, 2018,   86, 2024,   86,   86, 2019,   86,   86, 2030,
 
-     2025, 2023,   71, 2020, 2024,   71,   71,   71, 2019,   71,
-       71, 2027,   71, 2021,   71, 2022, 2026,   71, 2030, 2033,
-     3161, 2029,   71, 2028,   71, 2034, 2036, 2032,   71, 2031,
-       71, 2035,   71, 2037,   71, 2038, 2040,   71,   71,   71,
-       71, 2039, 2041, 2046,   71,   71, 2048, 3161, 2042,   71,
-     2043, 2050,   71, 2044, 2045,   71,   71, 2049, 2052,   71,
-       71, 2047,   71, 2053, 2051, 2055, 2054,   71,   71,   71,
-     2058,   71,   71,   71, 2056,   71,   71,   71,   71,   71,
-       71, 2059,   71,   71,   71, 2066,   71, 2061, 2057, 2062,
-     2063, 2070,   71,   71, 2060, 2065, 2069,   71, 2067, 2077,
+       86,   86, 2028,   86,   86,   86,   86, 2032, 2035, 2037,
+     2029,   86, 2031, 2033,   86,   86, 2027,  168,   86,   86,
+       86,   86, 2038, 2039, 2043, 2042,   86, 2044, 2036, 2034,
+     2040, 2045,   86, 2046,   86,   86, 2048,   86, 2041,   86,
+       86,   86,   86, 2049, 2050,   86, 2051,   86, 2054,   86,
+     2052,   86, 2053,   86, 2056, 2047,   86,   86, 2060,   86,
+       86, 2055, 2059, 2057,   86,   86,   86, 2064, 2058, 2061,
+     2062, 2063, 2065,   86,   86,   86,   86,   86,   86, 2072,
+     2070,   86,   86,   86, 2067,   86, 2071,   86,   86,   86,
+     2077,   86, 2074,   86, 2066, 2068,   86, 2069,   86,   86,
 
-     2071,   71, 2064, 2068, 2073,   71, 2072,   71,   71,   71,
-     2074,   71, 2076, 2075, 2079,   71,   71,   71, 2080,   71,
-       71,   71, 2085,   71, 2081, 2087, 2078,   71, 2083, 2084,
-     2089,   71,   71,   71, 2082,   71,   71, 2092, 2091,   71,
-     2086, 2088,   71,   71, 2093, 2097,   71, 2094,   71,   71,
-       71,   71,   71, 2098, 2095, 2103,   71, 2100, 2090, 2099,
-       71, 2104,   71, 2096,   71, 2107, 2102,   71,   71, 2101,
-     2109,   71, 2108,   71,   71, 2113,   71, 2105,   71, 2115,
-       71,   71, 2111,   71, 2106,   71, 2116,   71, 2118,   71,
-     2112, 2110, 2114,   71,   71, 2122, 2117, 2124, 2120, 2119,
+     2073, 2078, 2076,   86, 2081, 2075,   86, 2080, 2083, 2079,
+       86, 2082,   86,   86, 2085, 2088,   86, 2086, 2084,   86,
+       86,   86, 2089,   86, 2094,   86, 2087,   86,   86, 2096,
+       86,   86,   86, 2097, 2098,   86, 2090, 2091, 2092, 2093,
+     2099, 2100,   86,   86, 2095,   86, 2101, 2103,   86, 2102,
+       86,   86,   86,   86,   86, 2104,   86, 2107,   86,   86,
+       86, 2108,   86,   86,   86,   86, 2115,   86, 2119,   86,
+     2110, 2106, 2105,   86, 2111, 2109, 2112, 2118, 2114, 2116,
+       86,   86,   86,   86, 2122, 2113,   86, 2117, 2123,   86,
+       86, 2120, 2126,   86, 2125,   86,   86,   86, 2128,   86,
 
-       71, 2121, 2125,   71,   71,   71,   71,   71,   71, 2126,
-       71, 2129, 2130,   71,   71, 2123, 2127, 2128, 2134,   71,
-       71, 2131, 2133,   71,   71,   71,   71,   71,   71,   71,
-     2132,   71, 2135,   71, 2143,   71, 2140, 2141, 2136, 2137,
-     2138,   71, 2139,   71, 2145,   71, 2144,   71, 2142, 2146,
-       71, 2148,   71,   71, 2149,   71, 2153,   71, 2152, 2154,
-       71, 2158, 2147,   71, 2155, 2150, 2156,   71, 2159,   71,
-     2151, 2161, 2157, 2163, 2164,   71, 2162,   71, 2165,   71,
-       71,   71, 2160,   71, 2168,   71,   71, 2169,   71, 2166,
-     2173,   71,   71, 2174,   71,   71, 2177, 2172,   71,   71,
+     2121,   86, 2124, 2129, 2127,   86, 2130,   86, 2132, 2134,
+       86,   86, 2136, 2131, 2138,   86,   86, 2133,   86,   86,
+     2135, 2141,   86, 2140,   86, 2137,   86, 2142,   86, 2143,
+     2146,   86,   86,   86,   86,   86,   86, 2147,   86, 2149,
+     2152,   86, 2139,   86, 2144,   86, 2148,   86, 2145, 2151,
+       86, 2153, 2157, 2150, 2156,   86, 2159, 2158, 2154,   86,
+       86, 2162,   86,   86,   86, 2155,   86, 2160,   86, 2164,
+       86, 2165, 2166,   86,   86, 2161, 2163,   86, 2167, 2171,
+       86,   86, 2173, 2169, 2168,   86, 2170, 2174,   86,   86,
+     2175,   86,   86,   86, 2178,   86,   86, 2176, 2179,   86,
 
-       71, 2170,   71, 2167, 2178, 2181, 2175,   71, 2179, 2180,
-       71, 2182, 2171, 2176,   71,   71,   71,   71, 2183,   71,
-     2185,   71,   71, 2186, 2187,   71,   71,   71,   71,   71,
-     2190,   71, 2196,   71, 2194, 2184,   71, 2189,   71,   71,
-     2197,   71, 2192, 2199, 2188, 2191,   71,   71, 2193,   71,
-       71,   71,   71, 2195, 2198, 2203, 2206,   71, 2201,   71,
-     2207,   71, 2204,   71,   71,   71, 2202, 2200,   71, 2205,
-       71,   71,   71,   71,   71,   71, 2219,   71, 2208, 2218,
-     2209, 2258, 2214,   71, 2212,   71, 2210, 2216, 2211, 2213,
-     2217,   71, 2215, 2220,   71,   71, 2222,   71, 2221, 2223,
+       86, 2172,   86, 2177,   86, 2180, 2183,   86, 2182,   86,
+       86,   86,   86,   86, 2184, 2181, 2187,   86, 2185,   86,
+     2186,   86, 2189, 2190, 2188,   86, 2192,   86, 2194,   86,
+     2193,   86, 2191, 2195,   86, 2197, 2198,   86, 2203,   86,
+     2202,   86, 2201, 2205,   86,   86, 2196,   86,   86, 2199,
+     2204, 2207,   86, 2208,  168, 2200, 2211, 2213,   86,   86,
+     2214, 2212,   86,   86, 2206, 2209,   86,   86, 2222,   86,
+     2215, 2218,   86,   86, 2219,   86, 2210, 2216, 2217, 2223,
+       86,   86, 2224,   86, 2227,   86,   86, 2225, 2220, 2233,
+       86, 2228,   86, 2229, 2230,   86,   86,   86, 2232, 2221,
 
-       71, 2225, 2226,   71, 2224, 2227,   71,   71,   71, 2230,
-       71,   71, 2228, 2233,   71,   71, 2234,   71,   71, 2231,
-     2229,   71, 2232, 2235, 2239,   71, 2240,   71,   71, 2242,
-       71,   71,   71, 2238,   71, 2236,   71, 2237, 2244,   71,
-       71, 2247,   71, 2248,   71, 2246, 2249, 2241,   71, 2243,
-       71, 2245,   71, 2252,   71, 2254,   71, 2250,   71, 2253,
-     2256,   71,   71,   71, 2251, 2259,   71, 2260, 2262,   71,
-       71, 2255,   71, 2266,   71,   71, 2257,   71, 2264,   71,
-       71,   71, 2261,   71, 2270, 2271,   71,   71,   71, 2263,
-       71, 2265, 2273,   71, 2269, 2267, 2274, 2276,   71,   71,
+       86, 2226, 2231,   86,   86,   86,   86, 2235,   86,   86,
+       86, 2238,   86,   86,   86, 2241, 2234,   86,   86,   86,
+     2236,   86, 2245, 2248, 2240, 2247,   86,   86, 2243,   86,
+     2237, 2239, 2242, 2244, 2250,   86, 2249,   86,   86,   86,
+     2246,   86, 2252,   86, 2255, 2258,   86,   86,   86, 2253,
+       86,   86,   86, 2251, 2256, 2259,   86, 2254,   86,   86,
+       86, 2257,   86, 3226,   86,   86,   86, 2260, 2271, 2261,
+     2270, 2266, 2272,   86, 2262, 2264, 2263, 2268, 2269, 2265,
+       86, 2267,   86,   86,   86, 2273, 2274,   86,   86, 2278,
+     2279,   86, 2280,   86,   86, 2275,   86,   86, 2276,   86,
 
-     2268,   71, 2272, 2275,   71,   71, 2278, 2279,   71, 2283,
-     2277,   71,   71,   71, 2285,   71,   71,   71, 2286, 2280,
-     2284, 2290, 2281,   71,   71, 2289,   71,   71, 2291,   71,
-       71, 2282, 2295, 2287,   71, 2288,   71, 2293, 2300, 2297,
-       71, 2298, 2292, 2302,   71, 2299,   71, 2294,   71,   71,
-       71, 2303,   71, 2304,   71, 2296,   71, 2307,   71,   71,
-       71, 2301,   71,   71, 3161, 2306, 2313, 2308, 2309, 2310,
-     2312, 2311,   71, 2314,   71, 2305,   71,   71, 2315,   71,
-       71, 2318, 2319, 2316,   71, 2317,   71, 2320,   71,   71,
-     2326,   71,   71,   71,   71, 2321,   71, 2322,   71, 2323,
+     2277,   86, 2283, 2286,   86, 2284,   86,   86, 2285, 2281,
+     2282, 2287, 2288,   86,   86, 2292,   86, 2293,   86, 2289,
+       86, 2295,   86,   86, 2297,   86, 2291,   86,   86,   86,
+     2300,   86,   86, 2290, 2299, 2301,   86, 2303,   86, 2294,
+       86, 2296, 2298,   86, 2307,   86, 2302,   86, 2306, 2309,
+       86,   86, 2304,   86,   86,   86, 2312,   86, 2313, 2305,
+     2311, 2315,   86,   86,   86,   86, 2308, 2319,   86, 2310,
+       86,   86,   86, 2314, 2316,   86, 2323,   86, 2317, 2324,
+       86,   86, 2326, 2318,   86, 2320, 2322, 2329,   86,   86,
+       86,   86,   86, 2321, 2325,   86, 2327, 2331,   86, 2328,
 
-     2324,   71, 2328,   71, 2333, 2325, 2329, 2327,   71,   71,
-       71, 3161, 2330, 2331, 2334, 2332, 2337,   71,   71, 2338,
-     2339,   71, 2336,   71,   71, 2342, 2340, 2343, 2335, 2341,
-       71,   71,   71,   71, 2344,   71,   71, 2346,   71,   71,
-       71, 2350, 2351,   71, 2345,   71, 2348,   71,   71, 2354,
-     2347,   71, 2353,   71, 2355, 2356,   71, 2352, 2349,   71,
-       71,   71, 2358,   71, 2357, 2360, 2361,   71,   71,   71,
-       71,   71,   71, 2363,   71, 2370, 2362,   71, 2367,   71,
-     2359,   71, 2369,   71,   71, 2366,   71,   71,   71, 2364,
-     2365, 2374, 2368, 2371,   71, 2378,   71, 2372,   71, 2377,
+       86, 2336,   86,   86,   86, 2332, 2338,   86, 2343, 2330,
+     2333, 2337,   86, 2334,   86, 2339,   86,   86,   86, 2342,
+       86, 2344,   86,   86, 2335, 2348,   86, 2353, 2350,   86,
+     2340, 2346, 2341,   86, 2351,   86, 2355,   86, 2347, 2345,
+       86, 2352,   86,   86,   86, 2356,   86,   86, 2349, 2357,
+     2360,   86, 2361,   86,   86,   86, 2354,   86,   86, 2359,
+     2362, 2368, 2358, 2363, 2364, 2366, 2367, 2365,   86,   86,
+     2371,   86,   86, 2372,   86, 2373,  168, 2370, 2369,   86,
+       86, 2375,   86, 2374,   86,   86, 2380,   86,   86,   86,
+       86,   86,   86, 2387,   86,   86,   86, 2382, 2378, 2381,
 
-       71,   71, 2373, 2383, 2376, 2375, 2379,   71,   71, 2380,
-     2381,   71, 2382,   71, 2385,   71, 2387,   71,   71, 2386,
-     2389,   71,   71, 2391,   71,   71,   71, 2390,   71, 2388,
-       71,   71,   71,   71, 2384, 2395,   71, 2397, 2398,   71,
-     2393, 2399,   71, 2392, 2394, 2400,   71, 2401,   71, 2402,
-       71,   71, 2403,   71,   71, 2405,   71, 2396, 2408,   71,
-       71, 2404, 2410,   71,   71, 2409, 2407,   71,   71,   71,
-     2406, 2413,   71,   71,   71, 2417, 2414,   71, 2411, 2412,
-     2418,   71, 2415,   71,   71, 2416, 2421, 2420, 2419, 2422,
-       71,   71, 2423,   71,   71,   71,   71,   71, 2430,   71,
+     2376, 2379, 2377, 2383,   86, 2384, 2386, 2385, 2390, 2388,
+     2391,   86,   86, 2392,   86, 2389, 2393,   86,   86, 2395,
+     2396, 2394, 2397,   86, 2399,   86,   86,   86,   86,   86,
+     2401,   86, 2398,   86,   86,   86, 2405,   86, 2406,   86,
+       86, 2400,   86, 2402,   86, 2408, 2409, 2403, 2414,   86,
+       86, 2407, 2410, 2404, 2411,   86,   86, 2413,   86,   86,
+       86, 2412,   86, 2416, 2417,   86,   86, 2419,   86,   86,
+     2415,   86,   86, 2418,   86, 2423, 2426,   86,   86, 2425,
+       86,   86,   86, 2422, 2427,   86, 2420,   86, 2421,   86,
+     2430,   86, 2424,   86, 2435, 2428, 2434,   86,   86, 2429,
 
-     2427,   71, 2429, 2431,   71, 2424, 2426, 2425, 2432,   71,
-     2433,   71,   71, 2434,   71,   71, 2428,   71, 2437, 2436,
-       71, 2438,   71,   71,   71, 2443,   71, 2439,   71,   71,
-     2435, 2445,   71,   71, 2440, 2446,   71,   71,   71,   71,
-     2442, 2448,   71, 2441, 2447, 2449,   71, 2444,   71, 2450,
-       71, 2452, 2455,   71,   71,   71,   71,   71,   71, 2451,
-       71, 2462, 2453, 2456,   71,   71,   71,   71, 2454, 2459,
-       71,   71, 2461, 2463,   71, 2458, 2457, 2469,   71,   71,
-     2464, 2460, 2465, 2471, 2466,   71, 2473,   71, 2474,   71,
-     2472,   71, 2467, 2470, 2468,   71, 2475,   71, 2476,   71,
+       86, 2432, 2431, 2433,   86, 2436, 2437, 2438,   86, 2439,
+       86,   86, 2442, 2440,   86, 2444,   86,   86, 2443, 2446,
+       86,   86, 2448,   86, 2441,   86, 2447,   86, 2445,   86,
+       86,   86,   86,   86,   86, 2452, 2458, 2454, 2455, 2456,
+       86, 2450,   86, 2449,   86, 2451, 2457,   86,   86, 2459,
+     2460,   86,   86,   86, 2465,   86, 2462, 2453,   86,   86,
+       86,   86, 2467, 2470,   86, 2464, 2461, 2466,   86,   86,
+       86, 2463, 2471,   86, 2474, 2469,   86, 2468, 2475,   86,
+     2472, 2476,   86,   86,   86,   86,   86, 2480, 2473, 2479,
+       86,   86, 2478,   86,   86, 3226,   86,   86, 2483, 2484,
 
-     2477,   71,   71,   71,   71,   71,   71,   71,   71, 2478,
-       71,   71, 2479, 2487,   71,   71, 2485,   71, 2491, 2492,
-       71, 2480, 2482, 2481,   71,   71, 2484, 2483, 2486,   71,
-     2488,   71, 2489, 2490, 2494, 2495,   71,   71, 2496, 2497,
-       71,   71,   71,   71,   71,   71, 2493,   71, 2500, 2498,
-     2506,   71, 2507,   71,   71, 2499,   71, 2501,   71,   71,
-       71, 2502, 2503, 2504, 2505, 2509, 2510,   71, 2511,   71,
-       71, 2513, 2508,   71,   71, 2515, 2512,   71,   71, 2514,
-     2519,   71, 2518, 2520,   71,   71,   71, 2521,   71, 2516,
-     2522,   71,   71, 2517,   71, 2524,   71,   71,   71,   71,
+     2477, 2486, 2487,   86, 2481, 2482, 2488,   86, 2489,   86,
+     2490,   86,   86, 2485,   86, 2492,   86, 2494,   86, 2493,
+       86, 2495,   86,   86, 2491,   86, 2500,   86,   86,   86,
+     2496, 2502,   86,   86, 2497, 2503,   86,   86,   86,   86,
+     2504, 2499,   86, 2498, 2506, 2505,   86, 2501,   86,   86,
+     2507, 2509, 2512,   86,   86,   86,   86,   86, 2513, 2508,
+       86,  168, 2510,   86, 2520,   86,   86,   86, 2511, 2516,
+       86,   86,   86, 2519, 2518, 2515, 2521,   86, 3226,   86,
+     2514, 2517, 2527, 2524,   86, 2522, 2523,   86, 2525, 2529,
+       86, 2528, 2530, 2531,   86, 2526, 2532,   86,   86, 2533,
 
-     2523, 2528,   71,   71, 2526,   71, 2532, 2525, 2533,   71,
-     2536,   71,   71, 2534, 2527,   71, 2537, 2529, 2530,   71,
-       71,   71, 2531, 2535, 2539, 2540,   71,   71,   71,   71,
-     2538,   71, 2541, 2545,   71,   71, 2542, 2549,   71, 2548,
-     2547, 2546,   71, 2551,   71,   71,   71, 2543, 2544,   71,
-     2552,   71, 2556,   71,   71, 2553,   71, 2557, 2559,   71,
-       71, 2550,   71, 2555,   71, 2554, 2564,   71,   71,   71,
-     2566,   71, 3161, 2560,   71, 2561, 2558, 2562, 2563, 2565,
-       71,   71,   71,   71,   71, 2567, 2568, 2570, 2569,   71,
-       71, 2571,   71,   71,   71,   71,   71,   71, 2573, 2576,
+       86, 2534,   86, 2535,   86,   86,   86,   86, 2536,   86,
+       86,   86,   86,   86,   86, 2537, 2546,   86,   86,   86,
+     2544, 2539,   86, 3226, 2538,   86, 2550, 2540, 2541, 2551,
+       86, 2542, 2543, 2545,   86,   86, 2548, 2547, 2554,   86,
+     2549, 2552,   86, 2553, 2555, 2556,   86,   86,   86,   86,
+       86,   86,   86, 3226,   86, 2559, 2565,   86, 2566,   86,
+     2557,   86, 2569,   86, 2560, 2558,   86,   86, 2561, 2562,
+     2563, 2564, 2568, 2570,   86, 2571,   86,   86,   86, 2567,
+       86,   86,   86, 2575,   86, 2572,   86,   86, 2579, 2578,
+       86, 2573, 2580,   86,   86,   86, 2574, 2581, 2582,   86,
 
-     2574, 2577, 2581, 2572,   71, 2575, 2579,   71, 2578, 2580,
-       71,   71, 2585,   71,   71, 2583, 2582, 3161,   71, 2586,
-       71, 2587, 2584,   71,   71, 2590,   71, 3161, 2588, 2589,
-     2591,   71, 2593,   71,   71, 2595, 2592, 2594,   71,   71,
-     2596,   71, 2599, 2597, 2598,   71,   71,   71,   71, 2600,
-       71, 2601,   71,   71,   71, 2606, 2602, 2607,   71, 2608,
-     2604,   71,   71,   71,   71, 2603,   71, 2610,   71, 2611,
-     2609,   71,   71, 2613, 2605,   71, 2612, 2614,   71,   71,
-     2619,   71,   71,   71,   71,   71, 2621, 2617, 2616, 2615,
-     2618, 2620,   71,   71,   71, 2626,   71,   71,   71, 2622,
+     2576,   86, 2577, 2584,   86,   86, 2583,   86,   86, 2585,
+     2588,   86,   86, 2586,   86, 2592, 2593,   86,   86, 2596,
+       86,   86,   86,   86, 2587, 2597,   86, 2589, 2591, 2594,
+     2590,   86, 2600,   86,   86, 2599, 2595, 2598, 2602, 2601,
+       86, 2605,   86,   86,   86,   86, 2609,   86,   86, 2608,
+     2611,   86,   86, 2607, 2603, 2606,   86, 2612,   86,   86,
+     2604, 2616,   86,   86, 2617, 2613,   86, 2610, 2619,   86,
+       86, 2615,   86,   86, 2614,   86, 2624,   86,   86, 2626,
+       86,   86, 2622, 2620, 2623, 2621, 2627,   86, 2618,   86,
+       86,   86, 2628, 2625,   86, 2630,   86,   86,   86, 2631,
 
-     2629,   71, 2623,   71, 2624, 2630,   71, 2628,   71,   71,
-       71, 2635,   71, 2625, 2634, 2637, 2627, 2638, 2632, 2639,
-     2631,   71,   71,   71,   71,   71, 2640,   71, 2633, 2642,
-     2641,   71,   71,   71, 2636,   71,   71, 2645,   71, 2648,
-     2643,   71, 2650,   71,   71, 2644, 2651,   71, 2653, 2646,
-       71, 2647, 2652,   71,   71, 2654, 2655,   71,   71, 2649,
-       71, 2659,   71, 2657,   71, 2662, 2660,   71, 2663,   71,
-     2664,   71, 2658,   71, 2656,   71, 2665,   71,   71, 2669,
-       71,   71, 2661,   71, 2670, 2671,   71,   71, 2666, 2673,
-       71,   71,   71, 2677,   71, 2667, 2672,   71, 2668,   71,
+       86,   86,   86, 2629,   86, 2633, 2634, 2636, 2642, 2637,
+     2639,   86, 2635, 2632,   86, 2638, 2640,   86, 2641,  168,
+       86,   86, 2646,   86,   86, 2643,   86, 2648,   86, 2647,
+       86,   86, 2644, 2651,   86, 2650, 2652,   86, 2649, 2645,
+     2654,   86,   86, 2656, 2653, 2655,   86,   86, 2657,   86,
+       86, 2658, 2659, 2661,   86,   86,   86,   86, 2662,   86,
+     2663,   86,   86,   86, 2660, 2664,   86, 2668, 2669, 2666,
+       86, 2670, 2665,   86,   86, 2671,   86,   86,   86,   86,
+     2673, 2672, 2674, 2667, 2675,   86,   86,   86,   86,   86,
+     2676,   86, 2681,   86, 2683,   86, 2677, 2679, 2680, 2678,
 
-     2674, 2678,   71,   71,   71, 2680, 2676, 2679,   71, 2675,
-     2681,   71,   71, 2686, 2689,   71,   71, 2682, 2685,   71,
-     2688,   71, 2687,   71, 2683,   71, 2690,   71, 2684,   71,
-     2692, 2691, 2694,   71,   71,   71,   71, 3161, 2697,   71,
-       71, 2701,   71,   71,   71,   71,   71, 2703, 2711,   71,
-     2693, 2695, 2696, 2698, 2700, 2704, 2699, 2702, 2706, 2705,
-       71, 2708,   71, 2712,   71, 2710, 2709,   71, 2707,   71,
-     2713,   71, 2714,   71, 2715,   71,   71,   71,   71,   71,
-     2716, 2717,   71,   71, 2721,   71,   71, 2725,   71,   71,
-       71, 2722, 2726, 2728,   71, 2718,   71, 2720, 2730,   71,
+       86, 2684, 2682,   86,   86,   86, 2685, 2688,   86,   86,
+       86, 2692,   86, 2690,   86,   86,   86,   86, 2697,   86,
+       86, 2696,   86, 2686, 2687, 2691, 2699, 2704, 2689, 2700,
+     2694, 2701,   86, 2693,   86,   86, 2695,   86, 2702,   86,
+       86,   86, 2703,   86,   86, 2698,   86, 2707,   86, 2705,
+       86, 2710, 2712,   86, 2706, 2713,   86,   86, 2708, 2714,
+       86, 2709, 2716,   86, 2717,   86, 2711, 2715,   86,   86,
+       86, 2721,   86,   86, 2719,   86, 2722,   86,   86, 2724,
+     2725,   86, 2720, 2726,   86,   86,   86,   86, 2718, 2727,
+       86, 2729, 2723, 2731,   86, 2730,   86, 2732, 2728, 2733,
 
-       71, 2727, 2753, 2719,   71, 2723, 2724, 2729,   71, 2731,
-     2732,   71,   71,   71, 2736, 2737,   71, 2733,   71,   71,
-       71, 2734, 2735, 2738, 2741,   71,   71, 2739,   71, 2742,
-       71, 2746,   71, 2747,   71, 2740, 2745, 2744, 2743, 2748,
-       71,   71,   71,   71,   71,   71,   71,   71, 2757,   71,
-       71,   71,   71, 2752,   71, 2749, 2755, 2760,   71,   71,
-     2762, 2751, 2758, 2761,   71,   71, 2756, 2750, 2772,   71,
-     2754,   71, 2759, 2763, 2764,   71, 2765, 2767,   71, 2766,
-     2768,   71, 2769,   71,   71, 2771,   71,   71, 2774, 2778,
-       71, 2773, 2775, 2770,   71, 2776, 2777,   71,   71,   71,
+       86,   86, 2734, 2735,   86,   86, 2739,   86, 2737, 2740,
+       86, 2741,   86,   86, 2736, 2742,   86,   86,   86, 2738,
+     2743,   86, 2747, 2748,   86,   86,   86, 2751,   86,   86,
+     2750,   86,   86, 2753,   86, 2754, 2744, 2745, 2746, 2752,
+       86,   86, 2757, 2756,   86,   86,   86,   86,   86, 2749,
+     2760,   86, 2764,   86,   86,   86, 2755,   86, 2766,   86,
+       86, 2758, 2759, 2803, 2761, 2763, 2767, 2762, 2765,   86,
+     2771, 2768, 2774,   86,   86, 2772,   86, 2770, 2769, 2773,
+       86, 2775,   86, 2776,   86, 2777,   86, 2778,   86,   86,
+     2779,   86,   86, 2780,   86,   86,   86,   86,   86, 2784,
 
-       71, 2782,   71,   71, 2780, 2784,   71,   71,   71,   71,
-       71,   71, 2785,   71, 2786, 2787,   71, 2788, 2781, 2779,
-     2792,   71, 2789,   71,   71,   71, 2790, 2783,   71, 2795,
-       71,   71,   71, 2791,   71,   71, 2793, 2794,   71, 2796,
-     2799,   71,   71, 2800, 2797, 2804,   71, 2806,   71,   71,
-     2798, 2801, 2802, 2807,   71, 2809,   71,   71,   71,   71,
-     2805, 2803,   71, 2814,   71,   71,   71, 2813,   71,   71,
-     2808,   71, 2818, 2810, 2811, 2812,   71, 2821,   71,   71,
-     2823,   71,   71, 2819,   71, 2815,   71, 2817,   71, 2816,
-     2826,   71,   71, 2824,   71, 2820, 2827,   71,   71, 2822,
+     2788,   86,   86,   86, 2785, 2789, 2791,   86,   86, 2781,
+     2792, 2783, 2793,   86,   86, 2790, 2786, 2782, 2787, 2794,
+     2795,   86,   86,   86,   86,   86, 2799, 2800,   86, 2801,
+       86, 2796, 2797, 2798,   86, 2804,   86,   86,   86, 2802,
+     2805,   86, 2808,   86,   86, 2807,   86, 2806, 2809, 2810,
+       86, 2811,   86,   86,   86,   86,   86,   86, 2812,   86,
+       86, 2820, 2813, 2815, 2814, 2816, 2818,   86,   86,   86,
+       86, 2821,   86, 2823, 2824, 2903, 2819,   86, 2825, 2826,
+     2817, 2822,   86,   86,   86, 2828,   86, 2827, 2829, 2830,
+       86, 2831,   86, 2832,   86, 2833,   86,   86, 2837,   86,
 
-     2829,   71, 2828, 2825, 2833, 2831, 2834, 2832,   71,   71,
-       71, 2835,   71, 2838,   71,   71,   71, 2840, 2839,   71,
-     2830, 2836, 2841, 2843, 2844,   71, 2846,   71, 2837,   71,
-     2845,   71,   71,   71,   71,   71, 2851,   71, 2848, 2842,
-     2849,   71,   71, 2854,   71,   71,   71,   71,   71, 2847,
-     2859,   71,   71, 2850, 2852, 2853,   71, 2855,   71, 2856,
-     2858, 2861, 2862,   71, 2863,   71, 2871, 2860,   71,   71,
-     2865, 2857,   71, 2864, 2866, 2867,   71, 2868,   71, 2869,
-       71,   71, 2873,   71, 2870,   71, 2872,   71,   71,   71,
-       71, 2878, 2879,   71,   71,   71,   71, 2883,   71, 2884,
+       86,   86, 2836, 2834,   86, 2838, 2839, 2840,   86,   86,
+       86,   86,   86, 2846,   86, 2835, 2844, 2841,   86,   86,
+       86, 2842, 2848,   86, 2849,   86, 2852,   86,   86,   86,
+     2845, 2843, 2850, 2851,   86, 2856,   86, 2853,   86, 2847,
+       86,   86,   86,   86, 2854, 2859,   86,   86,   86,   86,
+       86, 2857, 2860, 2858, 2855, 2863,   86, 2865, 2861, 2868,
+       86, 2864,   86, 2870,   86, 2862,   86, 2866, 2871,   86,
+     2873,   86,   86,   86,   86,   86, 2867, 2878,   86,   86,
+     2877, 2869,   86,   86,   86, 2882,   86, 2872, 2874, 2875,
+     2876,   86, 2885,   86,   86, 2887,   86,   86,   86, 2879,
 
-       71, 2885,   71, 3161, 2874, 2882,   71,   71, 2880, 2875,
-     2876, 2877,   71, 2889,   71, 2881,   71, 2888, 2890,   71,
-       71, 2891, 2886, 2893,   71, 2887,   71,   71,   71,   71,
-     2896,   71,   71, 2897, 2892, 2895, 2894,   71,   71,   71,
-       71,   71, 2900,   71,   71, 2902, 2898,   71, 2903,   71,
-     2901,   71, 2899,   71,   71,   71,   71,   71,   71, 2921,
-     2904, 2912, 2913, 2905, 2906, 2907, 2915, 2908,   71, 2914,
-     2909, 2910,   71, 2916,   71, 2911, 2919,   71, 2917, 2920,
-       71,   71,   71, 2924,   71, 3161, 2922, 2918, 2925,   71,
-     2926, 2927,   71,   71, 2928, 2929, 2932,   71,   71, 2930,
+     2883,   86, 2881, 2888,   86, 2880, 2890,   86, 2891,   86,
+     2884, 2893,   86,   86, 2886, 2895,   86, 2892, 2889, 2898,
+       86,   86, 2896,   86,   86,   86, 2902,   86,   86, 2904,
+       86, 2894, 2907, 2900, 2908,   86, 2897,   86,   86, 2899,
+     2909, 2910, 2905, 2901, 2906,   86,   86,   86, 2913,   86,
+       86, 2912,   86, 2916,   86, 2914,   86, 2919,   86,   86,
+       86,   86,   86, 2911, 2924,   86, 2920,   86,   86, 2927,
+       86, 2915,   86, 2917, 2918, 2923, 2926, 2929, 2921, 2928,
+       86,   86,   86,   86, 2932,   86, 2922, 2925, 2931, 2933,
+       86, 2934,   86, 2936,   86, 2930,   86, 2938,   86,   86,
 
-     2931, 2923,   71, 2933,   71,   71,   71,   71,   71, 2939,
-       71,   71,   71, 2938,   71,   71, 2934,   71,   71, 2935,
-       71, 2941, 2942,   71, 2943, 2956, 2936, 2937,   71, 2946,
-     2945,   71, 2944,   71, 2947,   71, 2940, 2948,   71, 2949,
-       71,   71,   71, 2950, 2952, 2954, 2951, 2953, 2957,   71,
-     2955,   71,   71,   71,   71, 2963,   71, 2958, 2960, 2961,
-     2964,   71, 2966,   71, 2967,   71,   71, 2965,   71,   71,
-     2959, 2962, 3161, 2968, 2969,   71, 2970,   71, 2971, 2972,
-       71, 2973,   71, 2974,   71, 2975,   71, 2976,   71, 2977,
-       71, 2978,   71,   71, 2980,   71,   71,   71,   71,   71,
+       86, 2937,   86,   86,   86, 2943, 2944,   86, 2935,   86,
+       86,   86, 2950, 2939, 2948,   86, 2949,   86,   86,   86,
+     2947,   86, 2940, 2945, 2941, 2942,   86, 2954,   86,   86,
+     2946, 2953, 2955,   86, 2956,   86, 2958,   86,   86, 2951,
+     2952,   86,   86, 2961,   86, 2960, 2962,   86,   86, 2957,
+     2959,   86,   86,   86,   86,   86, 2965,   86,   86, 2967,
+       86,   86, 2968,   86, 2966,   86,   86, 2963, 2964,   86,
+       86, 2977,   86,   86, 2969, 2978, 2973, 2970, 2971, 2972,
+     2974, 2975, 2980,   86,   86,   86, 2976,   86,   86, 2979,
+     2981, 2986, 2982, 2984,   86,   86, 2983, 2985,   86, 3059,
 
-       71,   71, 2979, 2985,   71, 2981,   71,   71,   71, 2982,
-       71, 2989,   71, 2988, 2986, 2991,   71,   71, 2983, 2984,
-     2987, 2990,   71,   71, 2995, 2993, 2992,   71, 2998,   71,
-     2997,   71,   71,   71,   71, 2996, 3000,   71, 2994,   71,
-       71,   71,   71, 2999,   71, 3004,   71, 3008,   71, 3003,
-     3005, 3001, 3010,   71,   71, 3002,   71, 3006, 3015, 3009,
-     3011,   71, 3012,   71,   71, 3014, 3007,   71,   71,   71,
-       71, 3013,   71,   71, 3021, 3020,   71, 3023,   71,   71,
-     3019, 3017,   71,   71, 3016,   71,   71,   71, 3022,   71,
-       71, 3018, 3024,   71, 3033,   71, 3030, 3025,   71, 3027,
+     2987, 2989,   86, 2988, 2990,   86, 2991, 2992,   86,   86,
+     2993, 2994, 2997,   86, 2995, 2996,   86,   86, 2998,   86,
+       86,   86,   86,   86, 3004,   86,   86,   86, 3003,   86,
+       86, 3007,   86, 3226, 2999, 3000, 3006,   86,   86, 3008,
+     3001,   86, 3002,   86, 3012, 3013,   86, 3009, 3014,   86,
+     3011, 3005,   86, 3015,   86, 3010, 3019, 3016, 3021,   86,
+       86, 3020,   86, 3017,   86,   86, 3018,   86,   86,   86,
+     3028,   86, 3025, 3026, 3029, 3023,   86, 3031,   86,   86,
+       86,   86, 3030, 3226, 3022, 3080, 3024,   86, 3027, 3032,
+       86,   86, 3033, 3034,   86, 3035,   86, 3037,   86, 3048,
 
-     3026, 3029, 3031, 3035,   71,   71, 3038,   71,   71,   71,
-     3028, 3040,   71,   71, 3032, 3034,   71, 3039, 3036,   71,
-     3041, 3042,   71, 3043,   71, 3037,   71,   71, 3044, 3046,
-       71,   71, 3047, 3045, 3051, 3048,   71,   71,   71,   71,
-       71, 3049,   71, 3054, 3056,   71, 3050, 3057,   71, 3053,
-     3052,   71, 3060,   71,   71,   71,   71, 3058,   71, 3055,
-     3063,   71,   71, 3064, 3065, 3067, 3068,   71,   71, 3061,
-     3059,   71,   71, 3062,   71,   71,   71, 3066,   71, 3073,
-       71, 3069,   71, 3072, 3074,   71,   71, 3070,   71, 3075,
-       71,   71, 3078,   71, 3071, 3080, 3076,   71,   71,   71,
+     3036, 3038,   86, 3039,   86, 3040,   86, 3041,   86, 3042,
+       86, 3043,   86,   86, 3045,   86,   86,   86,   86, 3050,
+       86,   86, 3044,   86,   86, 3046,   86,   86, 3054, 3047,
+       86, 3056,   86,   86, 3060, 3053, 3051, 3049,   86, 3052,
+       86, 3058, 3057,   86, 3063, 3055, 3062,   86,   86,   86,
+       86,   86,   86, 3065,   86,   86,   86,   86, 3061,   86,
+       86, 3064, 3069, 3073, 3070, 3075,   86, 3071, 3066, 3067,
+     3068,   86, 3074, 3076,   86, 3077,   86,   86,   86,   86,
+       86,   86,   86, 3072,   86,   86, 3079, 3085,   86,   86,
+     3086,   86, 3084, 3082, 3078,   86, 3088,   86, 3081, 3087,
 
-     3077,   71, 3079,   71, 3085,   71, 3082,   71, 3086, 3161,
-     3081, 3083, 3087,   71, 3091,   71, 3084,   71, 3093,   71,
-     3094, 3088, 3092, 3089,   71,   71, 3090,   71,   71,   71,
-     3095, 3099, 3096, 3097, 3100,   71,   71,   71, 3102,   71,
-       71, 3101,   71,   71, 3103,   71,   71, 3108, 3098,   71,
-     3105,   71, 3111,   71,   71, 3112,   71,   71,   71,   71,
-       71, 3104,   71, 3115, 3106, 3107, 3113, 3110, 3109, 3114,
-       71, 3119,   71,   71,   71, 3118,   71, 3120, 3116, 3117,
-       71, 3123,   71, 3125,   71, 3126, 3121,   71,   71,   71,
-     3130,   71, 3127,   71,   71, 3124, 3128,   71, 3131, 3132,
+       86,   86, 3089, 3083, 3090,   86,   86,   86,   86, 3091,
+       86,   86,   86, 3092, 3095, 3098, 3094, 3100, 3096,   86,
+     3103,   86, 3101,   86,   86, 3093, 3105,   86, 3097,   86,
+     3106, 3099, 3104, 3107,   86, 3108,   86,   86,   86, 3102,
+       86, 3111,   86, 3109,   86, 3112,   86, 3113, 3116,   86,
+       86,   86,   86,   86,   86,   86, 3119, 3110, 3121,   86,
+       86, 3115, 3118, 3117, 3122,   86, 3125,   86, 3123, 3114,
+       86,   86, 3120,   86, 3124, 3126, 3128,   86,   86, 3129,
+     3132, 3130,   86, 3133,   86,   86,   86,   86, 3127,   86,
+     3131,   86, 3137, 3138,   86,   86, 3134, 3135, 3139,   86,
 
-     3122, 3133,   71,   71,   71,   71,   71, 3129,   71,   71,
-     3134, 3135,   71, 3136, 3137, 3139,   71, 3141,   71,   71,
-       71, 3145,   71, 3142, 3138, 3140,   71, 3143, 3146,   71,
-       71, 3149, 3150,   71,   71,   71, 3152,   71, 3144, 3153,
-       71, 3147, 3151,   71,   71, 3148,   71,   71, 3161, 3155,
-     3154, 3156, 3161, 3157, 3159,   71, 3160,   71, 3161, 3161,
-     3161, 3161, 3161, 3161, 3161, 3161, 3158,   43,   43,   43,
-       43,   43,   43,   43,   48,   48,   48,   48,   48,   48,
-       48,   53,   53,   53,   53,   53,   53,   53,   59,   59,
-       59,   59,   59,   59,   59,   64,   64,   64,   64,   64,
+       86,   86,   86,   86, 3136, 3143,   86,   86, 3145,   86,
+       86,   86, 3140,   86, 3142, 3141, 3150,   86, 3151,   86,
+     3147,   86, 3144, 3148, 3226, 3146, 3152,   86, 3149, 3156,
+       86,   86,   86, 3159, 3158,   86, 3157, 3153, 3155, 3154,
+       86,   86,   86,   86, 3164,   86, 3160, 3161, 3162, 3168,
+       86, 3165,   86,   86, 3163, 3167,   86,   86, 3166,   86,
+       86,   86, 3173,   86,   86,   86, 3170,   86,   86,   86,
+     3176, 3177,   86,   86,   86,   86, 3169, 3175, 3180, 3171,
+     3172,   86, 3174, 3178, 3181,   86, 3179,   86, 3184,   86,
+       86,   86, 3188, 3187, 3182, 3185,   86, 3190, 3183,   86,
 
-       64,   64,   74,   74, 3161,   74,   74,   74,   74,  143,
-      143, 3161, 3161, 3161,  143,  143,  145,  145, 3161, 3161,
-      145, 3161,  145,  147, 3161, 3161, 3161, 3161, 3161,  147,
-      150,  150, 3161, 3161, 3161,  150,  150,  152, 3161, 3161,
-     3161, 3161, 3161,  152,  154,  154, 3161,  154,  154,  154,
-      154,   75,   75, 3161,   75,   75,   75,   75,   13, 3161,
-     3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161,
-     3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161,
-     3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161,
-     3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161
+     3189,   86, 3186,   86, 3191,   86, 3192, 3195,   86,   86,
+       86,   86, 3193, 3197, 3196, 3198,   86, 3199, 3194,   86,
+       86,   86,   86, 3204,   86,   86, 3200, 3202,   86,   86,
+       86,   86,   86, 3206, 3207,   86, 3210, 3211,   86, 3201,
+     3203,   86,   86, 3214, 3205, 3215,   86,   86,   86, 3208,
+     3209, 3212, 3217,   86, 3216, 3218,   86,   86,   86,   86,
+     3213,   86, 3226, 3220, 3219, 3226, 3221, 3222, 3224,   86,
+     3225,   86, 3226, 3226, 3226, 3226, 3226, 3226, 3223,   47,
+       47,   47,   47,   47,   47,   47,   52,   52,   52,   52,
+       52,   52,   52,   57,   57,   57,   57,   57,   57,   57,
 
+       63,   63,   63,   63,   63,   63,   63,   68,   68,   68,
+       68,   68,   68,   68,   74,   74,   74,   74,   74,   74,
+       74,   80,   80,   80,   80,   80,   80,   80,   89,   89,
+     3226,   89,   89,   89,   89,  158,  158, 3226, 3226, 3226,
+      158,  158,  160,  160, 3226, 3226,  160, 3226,  160,  162,
+     3226, 3226, 3226, 3226, 3226,  162,  165,  165, 3226, 3226,
+     3226,  165,  165,  167, 3226, 3226, 3226, 3226, 3226,  167,
+      169,  169, 3226,  169,  169,  169,  169,  172, 3226, 3226,
+     3226, 3226, 3226,  172,  175,  175, 3226, 3226, 3226,  175,
+      175,   90,   90, 3226,   90,   90,   90,   90,   17, 3226,
+
+     3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226,
+     3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226,
+     3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226,
+     3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226
     } ;
 
-static const flex_int16_t yy_chk[6200] =
+static const flex_int16_t yy_chk[6340] =
     {   0,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         3,    3,    3,    4,    4,    4,    5,    5,    6,    6,
-        5,    3,    6,   20,    4,   20,   20,    5,   20,    6,
-        7,    7,    7,    7,   20,    7,    8,    8,    8,    8,
-       29,    8,    7,    9,    9,    9,   22,   22,    8,   10,
-       10,   10,   15,   25,    9,   29,   15,   25,  246,   31,
-       10,   11,   11,   11,   11,   11,   11,   19,   79,   19,
+        5,    3,    6,   24,    4,   24,   24,    5,   24,    6,
+        7,    7,    7,    7,   24,    7,    8,    8,    8,    8,
+       33,    8,    7,    9,    9,    9,   26,   26,    8,   10,
+       10,   10,   19,   29,    9,   33,   19,   29, 3234,   35,
+       10,   11,   11,   11,   11,   11,   11,   13,   13,   13,
 
-       19,   30,   19,   11,   31,   79,   30,   25,   19,   19,
-       36,  246,   11,   12,   12,   12,   12,   12,   12,   21,
-       23,   23,   21,   21,   36,   12,   21,   34,   23,   26,
-       26,   21,   23,   72,   12,   23,   42,   72,   27,   27,
-       21,   24,   47,   47,   26,   28,   24,   27,   34,   28,
-       24,   42,   28,   24,   52,   24,   24,   52,   27,   28,
-       81,   28,   32,   32,   33,   33,   24,   41,   41,   33,
-      706,   32,   41,   35,   37,   37,   41,   32,   35,   37,
-       81,   32,   35,   39,   39,   33,   39,  706,   35,   37,
-       37,   35,   37,   40,   38,   39,   69,   40,   35,   38,
+       13,   34,   13,   11,   35,   99,   34,   29,   38,   13,
+       51,   51,   11,   12,   12,   12,   12,   12,   12,   14,
+       14,   14,   14,   99,   14,   12,   15,   15,   15,   38,
+       23,   14,   23,   23,   12,   23,   46,   15,   16,   16,
+       16,   23,   23,   25,   27,   27,   25,   25, 2641,   16,
+       25,   46,   27,   30,   30,   25,   27,   56,   40,   27,
+       56,   73,   31,   31,   25,   28,   67,   67,   30,   32,
+       28,   31,   40,   32,   28,   73,   32,   28,   92,   28,
+       28,   92,   31,   32, 1067,   32,   36,   36,   37,   37,
+       28,   45,   45,   37,  175,   36,   45,   39,   41,   41,
 
-       78,   39,   38,   58,   78,   58,   58,   40,   58,   38,
-       69,   40,   40,   38,   38,   63,   63,   66, 3167,   66,
-       66,   68,   66,   68,   68,   71,   68,   71,   71,   66,
-       71,   89,   74,   80,   74,   74,   71,   74,   77,   82,
-       84,   77,   82,   74,   74,   80,   83,   85,   88,   83,
-       86,   87,   90,   89,   91,   92,   85,   87,   84,   94,
-       91,   93,   83,   87,   86,   87,   88,   88,   96,   92,
-       95,   90,   97,   91,   98,   93,   99,  101,   98,   94,
-      100,   95,   95,  104, 1041,  100,   96,  108,  103,   95,
-       97,  101,  102,  111,  103,  102,   99,  107,  102,  105,
+       45,   36,   39,   41,   94,   36,   39,   43,   43,   37,
+       43,   94,   39,   41,   41,   39,   41,   44,   42,   43,
+       87,   44,   39,   42,   87,   43,   42,   62,   95,   62,
+       62,   44,   62,   42,  174,   44,   44,   42,   42,   70,
+       95,   70,   70,   72,   70,   72,   72,   79,   72,   79,
+       79,   70,   79,   84,   84,   86,   96,   86,   86,   89,
+       86,   89,   89,   93,   89,   97,   86,   93,   97,   98,
+       89,   89,   98,  100,  101,  102,   96,  103,  104,  105,
+      106,  102,  100,  107,  111,   98,  106,  102,  101,  102,
+      108,  109,  112,  172,  110,  103,  103,  107,  105,  106,
 
-      106,  108,  104,  106,  105,  109,  111,  106,  110,  109,
-      112,  102,  102,  103,  113,  110,  107,  112,  114,  115,
-      119,  107,  116,  106,  105,  117,  116,  113,  120,  120,
-      118,  121,  123,  124,  125,  118,  129,  115,  114,  118,
-      119,  122,  127,  117,  128,  122,  132,  123,  129,  126,
-      128,  121,  126,  125,  122,  127,  130,  130,  131,  124,
-      122,  133,  132,  126,  134,  131,  135,  126,  136,  137,
-      136,  139,  140,  138,  130,  152,  131,  130,  138,  136,
-      133,  137,  135,  139,  141,  134,  142,  144,  144,  141,
-      140,  136,  146,  157,  148,  146,  148,  148,  157,  148,
+      104,  114,  111,  113,  108,  110,  110,  113,  116,  115,
+      112,  109,  117,  110,  115,  117,  119,  118,  117,  120,
+      123,  114,  116,  118,  120,  126,  121,  122,  727,  121,
+      125,  117,  117,  121,  123,  119,  124,  125,  126,  128,
+      124,  127,  118,  129,  120,  727,  122,  130,  127,  121,
+      131,  122,  128,  132,  131,  133,  134,  135,  135,  136,
+      133,  139,  137,  129,  133,  130,  137,  138,  143,  140,
+      142,  132,  144,  148,  143,  137,  134,  141,  147,  136,
+      141,  137,  138,  142,  144,  145,  145,  139,  140,  146,
+      149,  141,  148,  150,  147,  141,  146,  151,  152,  151,
 
-      142,  151,  151,  153,  159,  153,  153,  154,  153,  154,
-      154,  156,  154,  160,  156,  158,  161,  163,  162,  154,
-      164,  158,  159,  165,  161,  163,  167,  166,  160,  162,
-      158,  161,  166,  168,  169,  170,  172,  172,  165,  164,
-      169,  169,  168,  171,  173,  178,  167,  174,  171,  174,
-      173,  177,  174,  175,  176,  176,  179,  175,  182,  181,
-      170,  179,  175,  177,  178,  180,  183,  175,  186,  174,
-      180,  181,  183,  175,  175,  184,  185,  187,  182,  184,
-      195,  185,  188,  191,  186,  190,  189,  192,  191,  194,
-      196,  187,  192,  197,  194,  183,  200,  188,  189,  197,
+      153,  154,  157,  145,  155,  153,  145,  146,  151,  150,
+      152,  149,  156,  154,  159,  159,  157,  156,  161,  167,
+      151,  161,  155,  163,  171,  163,  163,  171,  163,  166,
+      166,  168,  179,  168,  168,  169,  168,  169,  169,  173,
+      169,  173,  173,  177,  173,  176,  176,  169,  177,  178,
+      179,  180,  181,  183,  182,  178,  184,  185,  186,  187,
+      181,  183,  188,  186,  178,  182,  180,  181,  190,  191,
+      189,  188,  185,  198,  191,  184,  189,  189,  193,  187,
+      192,  192,  195,  194,  193,  194,  195,  197,  194,  196,
+      196,  195,  198,  190,  202,  199,  195,  201,  203,  197,
 
-      195,  189,  200,  190,  193,  193,  196,  199,  193,  201,
-      193,  198,  198,  199,  202,  203,  204,  205,  209,  199,
-      202,  203,  193,  205,  193,  209,  206,  207,  208,  201,
-      203,  206,  210,  207,  208,  211,  212,  204,  213,  214,
-      215,  211,  216,  218,  213,  210,  217,  219,  215,  220,
-      221,  217,  218,  222,  224,  216,  212,  226,  222,  222,
-      225,  214,  219,  223,  225,  220,  228,  227,  223,  229,
-      221,  230,  224,  227,  233,  229,  231,  235,  232,  226,
-      232,  231,  234,  235,  228,  228,  236,  237,  238,  234,
-      239,  230,  236,  233,  238,  240,  241,  241,  242,  242,
+      199,  200,  195,  195,  203,  194,  200,  204,  205,  201,
+      206,  204,  215,  205,  202,  207,  208,  210,  209,  211,
+      212,  230,  216,  214,  211,  212,  206,  203,  214,  207,
+      209,  208,  215,  209,  230,  210,  213,  213,  216,  217,
+      213,  219,  213,  218,  218,  217,  220,  219,  221,  222,
+      224,  223,  220,  219,  213,  222,  213,  223,  225,  232,
+      226,  227,  234,  228,  225,  226,  223,  227,  221,  228,
+      229,  224,  231,  235,  233,  236,  238,  229,  231,  232,
+      233,  235,  237,  239,  234,  238,  240,  237,  236,  241,
+      242,  246,  243,  244,  247,  242,  242,  243,  239,  245,
 
-      248,  243,  239,  245,  244,  245,  237,  243,  247,  240,
-      244,  249,  248,  247,  251,  250,  252,  253,  254,  261,
-      255,  252,  245,  250,  254,  243,  255,  256,  257,  258,
-      249,  259,  256,  257,  251,  258,  260,  261,  262,  263,
-      253,  264,  265,  267,  270,  267,  259,  263,  265,  273,
-      260,  266,  262,  274,  266,  268,  268,  269,  271,  271,
-      269,  280,  270,  272,  272,  273,  264,  275,  274,  276,
-      275,  277,  278,  276,  284,  280,  279,  281,  284,  283,
-      277,  278,  279,  281,  282,  283,  282,  285,  285,  286,
-      287,  288,  289,  290,  286,  284,  287,  288,  291,  295,
+      247,  248,  240,  245,  249,  250,  252,  251,  252,  241,
+      249,  244,  251,  246,  253,  254,  257,  255,  256,  248,
+      248,  258,  254,  255,  256,  250,  259,  258,  260,  261,
+      261,  262,  262,  253,  263,  257,  266,  264,  259,  268,
+      263,  269,  260,  264,  265,  267,  265,  270,  271,  272,
+      267,  268,  273,  284,  272,  270,  274,  165,  263,  266,
+      269,  275,  274,  265,  276,  277,  278,  275,  271,  276,
+      277,  279,  278,  280,  281,  273,  282,  283,  284,  287,
+      286,  287,  285,  286,  290,  283,  279,  280,  285,  293,
+      282,  294,  281,  288,  288,  289,  291,  291,  289,  292,
 
-      292,  293,  293,  294,  296,  297,  294,  298,  296,  299,
-      299,  290,  289,  292,  300,  301,  288,  295,  301,  291,
-      303,  302,  305,  308,  297,  298,  303,  304,  307,  150,
-      304,  384,  300,  302,  305,  301,  306,  307,  309,  310,
-      313,  308,  310,  309,  310,  306,  311,  384,  306,  311,
-      312,  318,  313,  306,  306,  306,  306,  317,  319,  314,
-      310,  314,  314,  312,  315,  316,  318,  319,  316,  315,
-      315,  320,  321,  321,  317,  324,  322,  317,  323,  323,
-      320,  322,  325,  326,  327,  328,  329,  325,  330,  333,
-      324,  342,  342,  334,  330,  326,  331,  331,  334,  331,
+      292,  295,  290,  296,  295,  293,  294,  296,  297,  298,
+      299,  300,  302,  301,  302,  303,  299,  297,  298,  301,
+      304,  303,  305,  305,  304,  300,  306,  307,  308,  309,
+      310,  306,  312,  307,  308,  311,  313,  313,  317,  314,
+      315,  304,  314,  316,  318,  312,  320,  316,  310,  309,
+      319,  319,  321,  308,  322,  321,  311,  317,  315,  323,
+      324,  325,  318,  324,  320,  323,  322,  327,  331,  328,
+      329,  331,  321,  325,  326,  329,  327,  330,  333,  164,
+      330,  338,  330,  326,  332,  336,  326,  328,  336,  162,
+      333,  326,  326,  326,  326,  337,  338,  332,  330,  334,
 
-      335,  329,  336,  327,  339,  328,  335,  336,  331,  333,
-      337,  338,  149,  341,  338,  337,  338,  340,  339,  343,
-      340,  337,  341,  344,  344,  343,  345,  348,  349,  350,
-      361,  345,  346,  340,  352,  346,  340,  351,  340,  354,
-      367,  346,  354,  147,  350,  346,  355,  348,  352,  349,
-      357,  361,  351,  346,  347,  347,  359,  347,  354,  358,
-      355,  359,  359,  360,  362,  357,  367,  363,  358,  360,
-      347,  374,  365,  347,  369,  347,  364,  347,  356,  368,
-      356,  356,  363,  362,  371,  364,  374,  145,  369,  366,
-      356,  365,  356,  356,  356,  366,  370,  356,  372,  368,
+      335,  334,  334,  344,  339,  335,  335,  340,  341,  341,
+      343,  343,  337,  339,  342,  337,  340,  345,  344,  342,
+      346,  347,  345,  348,  349,  350,  351,  351,  353,  351,
+      354,  350,  346,  362,  362,  354,  355,  359,  351,  349,
+      347,  356,  355,  348,  357,  361,  356,  358,  353,  357,
+      358,  359,  358,  360,  361,  357,  360,  363,  364,  364,
+      365,  368,  369,  363,  366,  365,  372,  366,  160,  360,
+      375,  381,  360,  366,  360,  370,  371,  366,  377,  374,
+      372,  368,  374,  369,  375,  366,  367,  367,  378,  367,
+      370,  371,  381,  377,  379,  380,  382,  378,  374,  379,
 
-      373,  376,  370,  375,  377,  379,  370,  371,  375,  380,
-      377,  378,  378,  381,  383,  387,  376,  382,  372,  385,
-      373,  380,  388,  382,  385,  379,  389,  381,  386,  386,
-      390,  386,  391,  393,  391,  387,  394,  393,  388,  383,
-      394,  392,  389,  392,  390,  395,  395,  396,  397,  398,
-      399,  401,  403,  400,  405,  394,  408,  143,  403,  405,
-      401,  392,  408,  397,  402,  398,  396,  400,  399,  402,
-      404,  401,  406,  401,  407,  409,  406,  402,  402,  404,
-      410,  402,  402,  407,  411,  414,  410,  412,  411,  413,
-      412,  415,  415,  416,  413,  418,  409,  417,  417,  419,
+      379,  380,  367,  383,  385,  367,  387,  367,  384,  367,
+      376,  388,  376,  376,  386,  382,  389,  384,  383,  391,
+      386,  392,  376,  385,  376,  376,  376,  390,  393,  376,
+      389,  388,  387,  390,  394,  395,  396,  390,  397,  399,
+      395,  392,  391,  400,  397,  398,  398,  401,  393,  394,
+      402,  396,  403,  404,  407,  400,  402,  405,  410,  399,
+      408,  401,  405,  406,  406,  409,  406,  413,  411,  404,
+      411,  413,  410,  416,  407,  414,  408,  403,  417,  414,
+      412,  409,  412,  412,  415,  415,  418,  419,  421,  420,
+      423,  426,  416,  417,  414,  426,  423,  421,  424,  422,
 
-      418,  420,  420,  421,  422,  414,  416,  423,  422,  421,
-      424,  425,  419,  426,  427,  427,  425,  428,  426,  429,
-      430,  431,  423,  427,  432,  434,  433,  432,  437,  428,
-      433,  424,  439,  431,  435,  435,  436,  434,  430,  429,
-      442,  436,  438,  438,  441,  441,  445,  443,  444,  437,
-      446,  448,  449,  450,  439,  443,  452,  444,  451,  455,
-      457,  442,  446,  457,  451,  452,  445,  450,  453,  448,
-      454,  448,  449,  455,  453,  454,  456,  458,  459,  460,
-      461,  464,  463,  462,  456,  460,  462,  456,  463,  465,
-      466,  458,  467,  459,  465,  464,  470,  468,  469,  471,
+      412,  425,  418,  420,  422,  419,  425,  424,  421,  427,
+      421,  429,  422,  422,  428,  430,  422,  422,  427,  431,
+      428,  430,  432,  431,  433,  432,  434,  435,  435,  433,
+      436,  438,  429,  437,  437,  439,  438,  440,  440,  441,
+      442,  443,  444,  436,  442,  441,  434,  445,  439,  446,
+      447,  447,  445,  448,  446,  449,  443,  451,  450,  447,
+      454,  452,  453,  444,  452,  448,  453,  455,  455,  451,
+      457,  459,  454,  456,  462,  449,  450,  463,  456,  458,
+      458,  461,  461,  464,  465,  463,  466,  468,  469,  470,
+      471,  457,  464,  459,  473,  462,  471,  472,  466,  475,
 
-      461,  468,  472,  469,  471,  473,  463,  474,  477,  493,
-      493,  470,  466,  467,  478,  479,  480,  484,  472,  479,
-      474,  481,  497,  482,  473,  475,  475,  482,  477,  478,
-      486,  475,  484,  475,  497,  480,  494,  481,  483,  475,
-      489,  475,  491,  483,  475,  475,  486,  483,  485,  486,
-      487,  475,  488,  485,  490,  492,  489,  490,  488,  487,
-      500,  494,  496,  488,  498,  491,  495,  495,  499,  501,
-      503,  502,  505,  504,  501,  492,  507,  496,  505,  498,
-      502,  510,  500,  511,  512,  507,  508,  499,  504,  503,
-      508,  509,  513,  510,  514,  515,  516,  509,  511,  517,
+      473,  158,  478,  470,  465,  468,  472,  468,  469,  474,
+      476,  479,  477,  475,  474,  477,  478,  480,  476,  481,
+      484,  476,  482,  480,  483,  482,  479,  485,  486,  488,
+      483,  487,  485,  488,  484,  489,  490,  491,  492,  481,
+      489,  493,  491,  494,  497,  499,  500,  501,  483,  499,
+      486,  490,  487,  498,  492,  502,  494,  504,   85,  502,
+      493,  495,  495,  501,  497,  500,  505,  495,  498,  495,
+      506,  505,  504,  503,  507,  495,  509,  495,  503,  508,
+      495,  495,  503,  507,  511,  508,  506,  495,  510,  506,
+      508,  510,  509,  512,  513,  513,  514,  515,  515,  516,
 
-      516,   70,  518,  512,  518,  522,  513,  519,  521,  514,
-      520,  520,  517,  515,  521,  519,  523,  522,  524,  526,
-      525,  527,  523,  525,  528,  529,  530,  531,  529,  528,
-      524,  533,  532,  526,   64,  530,  527,  532,  532,  534,
-      534,  541,  530,  531,  533,  530,  535,  535,  536,  537,
-      537,  538,  538,  539,  536,  540,  544,  545,  548,  539,
-      540,  540,  541,  542,  543,  545,  542,  546,  547,  543,
-      546,  549,  550,  547,  551,  544,  550,  553,  552,  554,
-      551,  548,  552,  555,  554,  556,  556,  557,  558,  559,
-      549,  560,  561,  562,  559,  553,  563,  555,  566,  562,
+      517,  518,  520,  519,  521,  524,  522,  511,  523,  521,
+      527,  525,  517,  512,  516,  522,  518,  525,  530,  527,
+      524,  514,  519,  531,  520,  528,  529,  523,  532,  528,
+      530,  533,  529,  534,  535,  536,  537,  571,  531,  536,
+      538,  571,  538,  539,  541,  533,  542,  532,  534,  537,
+      541,  539,  535,  540,  540,  543,  544,  545,  542,  546,
+      545,  543,  547,  549,  548,  550,  549,  551,  544,  548,
+      552,  597,  553,  546,  550,  552,  552,  547,  554,  554,
+      597,  550,  556,  551,  550,  553,  555,  555,  556,  557,
+      557,  558,  558,  559,  561,  560,  562,  565,  564,  559,
 
-      564,  563,  557,  565,  567,  567,  565,  560,  568,  558,
-      572,  565,  561,  569,  564,  565,  566,  570,  571,  573,
-      579,  575,  570,  571,  572,  579,  568,  575,  576,  569,
-      577,  578,  582,  577,  573,  578,  580,  576,  581,  580,
-      583,  585,  584,  581,  587,  586,  588,  588,  582,  584,
-      586,  589,  590,  591,  585,  593,  592,  578,  583,   59,
-      589,  624,  594,  600,  587,  592,  595,  593,  594,  591,
-      596,  590,  595,  596,  597,  597,  598,  597,  599,  598,
-      601,  600,  602,  599,  603,  604,  624,  605,  602,  603,
-      605,  604,  606,  607,  601,  608,  609,  606,  607,  607,
+      560,  560,  563,  564,  566,  563,  567,  569,  562,  567,
+      570,  572,  566,  568,  574,  561,  565,  572,  568,  573,
+      575,  576,  578,  573,  579,  575,  577,  577,  580,  570,
+      569,  581,  574,  580,  582,  576,  583,  578,  584,  585,
+      587,  589,  583,  584,   80,  579,  590,  581,  586,  588,
+      588,  586,  591,  585,  582,  593,  586,  591,  587,  589,
+      586,  592,  590,  594,  596,  598,  592,  599,  598,  593,
+      596,  599,  600,  601,  602,  603,  601,  600,  594,  602,
+      604,  605,  606,  608,  607,  609,  609,  610,  605,  607,
+      611,  603,  612,  599,  615,  606,  610,  613,  604,  614,
 
-      610,  611,  612,  613,  615,  610,  614,  611,  608,  609,
-      617,  614,  613,  616,  616,  618,  619,  617,  618,  610,
-      610,  612,  619,  620,  615,  621,  622,  623,  623,  626,
-      621,  622,  622,  618,  625,  620,  625,  627,  628,  627,
-      629,  630,  631,  632,  633,  634,  635,  636,  626,  634,
-      633,  637,  638,  639,  643,  635,  628,  640,  629,  630,
-      641,  631,  636,  632,  644,  642,  637,  645,  643,  640,
-      638,  642,  639,  646,  647,  641,  644,  648,  647,  650,
-      649,  651,  652,  653,  654,  657,  645,  656,  653,  655,
-      655,  656,  646,  659,  658,  648,  649,  650,  654,  651,
+      615,  616,  617,  608,  621,  617,  613,  616,  612,  611,
+      622,  614,  618,  618,  619,  618,  620,  619,  624,  623,
+      625,  620,  621,  624,  622,  623,  625,  626,  627,  628,
+      626,  629,  630,  627,  628,  628,  631,  632,  633,  634,
+      636,  631,  635,  632,  629,  630,  638,  635,  634,  637,
+      637,  639,  640,  638,  639,  631,  631,  633,  640,  641,
+      636,  642,  643,  644,  644,  645,  642,  643,  643,  639,
+      646,  641,  646,  647,  648,  649,  648,  650,  651,  652,
+      653,  654,  655,  659,  657,  656,  655,  654,  658,  660,
+      645,  662,  647,  649,  656,  650,  651,  661,  652,  657,
 
-      651,  652,  661,  660,  657,  658,  662,  659,  660,  663,
-      664,  665,  666,  669,  672,  667,  665,  664,  661,  666,
-      667,  668,  663,  670,  671,  662,  668,  673,  672,  674,
-      670,  669,  675,  671,  678,  676,  673,  675,  676,  677,
-      679,  674,  680,  677,  681,  682,  683,  683,  678,  679,
-      684,  684,  685,  685,  686,  688,  689,  680,  681,  684,
-      690,  691,  689,  686,  692,  691,  682,  693,  694,  695,
-      696,  698,  697,  699,  688,  695,  692,  700,  696,  697,
-      690,  703,  709,  723,  710,  713,  694,  712,  723,  698,
-      710,  709,  693,  712,  715,  715,  703,  700,  699,  701,
+      653,  659,  664,  658,  663,  665,  662,  666,  660,  661,
+      663,  667,  670,  669,  668,  671,  664,  665,  668,  672,
+      673,  675,  674,  676,  676,  677,  666,  674,  670,  677,
+      667,  669,  678,  671,  679,  675,  680,  672,  672,  673,
+      682,  681,  683,  686,  684,  679,  681,  685,  686,  690,
+      680,  678,  687,  688,  685,  689,  682,  684,  688,  687,
+      689,  683,  691,  692,  693,  694,  696,  690,  695,  691,
+      697,  696,  692,  697,  694,  698,  699,  700,  693,  698,
+      695,  701,  703,  702,  704,  704,  700,  706,  706,  707,
+      699,  705,  705,  709,  711,  710,  701,  702,  707,  713,
 
-      720,  713,  714,  717,  701,  718,  714,  721,  701,  716,
-      716,  701,  719,  721,  717,  724,  727,  725,  701,  701,
-      720,  701,  730,  718,  732,  729,  719,  722,  722,  722,
-      729,  722,  731,  726,  722,  725,  724,  726,  728,  722,
-      727,  730,  728,  734,  734,  722,  722,  731,  733,  732,
-      735,  733,  736,  736,  737,  738,  738,  735,  739,  740,
-      741,  744,  740,  739,  745,  741,  742,  742,  743,  737,
-      743,  746,  747,  744,  748,  746,  749,  750,  750,  751,
-      754,  752,  756,  745,  749,  753,  753,  755,  759,  759,
-      757,   54,  747,  748,  751,  752,  757,  758,  754,  755,
+      705,  710,  712,  703,  714,  715,  712,  716,  717,  719,
+      718,  713,  709,  716,  711,  720,  717,  718,  721,  724,
+      731,  730,  733,  715,  734,  741,  731,  719,  733,  714,
+      730,  735,  736,  734,  724,  746,  736,  740,  721,  741,
+      720,  722,   75,  722,  737,  737,  722,  735,  738,  738,
+      722,  739,  742,  722,  745,  740,  746,  749,  743,  745,
+      722,  722,  739,  722,  743,  747,  748,  750,  752,  754,
+      748,  750,  742,  744,  744,  744,  779,  744,  753,  751,
+      744,  749,  779,  747,  751,  744,  755,  752,  759,  755,
+      756,  744,  744,  753,  754,  756,  756,  757,  758,  758,
 
-      760,  763,  758,  762,  756,  760,  760,  763,  762,  764,
-      767,  765,  766,  767,  768,  764,  765,  769,  766,  772,
-      768,  770,  770,  771,  771,  769,  773,  772,  774,  775,
-      776,  777,  777,  774,  778,  780,  775,  779,  781,  783,
-      785,  780,  784,  778,  773,  779,  787,  786,  783,  776,
-      788,  784,  786,  788,  789,  787,  790,  781,  791,  789,
-      792,  793,  794,  796,  785,  795,  795,  794,  794,  792,
-      790,  797,  798,  799,  793,  802,  800,  802,  796,  800,
-      804,  798,  806,  791,  803,  803,  805,  800,  807,  808,
-      797,  805,  809,  810,  812,  811,  813,  799,  814,  815,
+      760,  760,  761,  759,  757,  762,  763,  761,  762,  764,
+      764,  763,  765,  766,  765,  767,  768,  769,  771,  770,
+      768,  772,  772,  777,  773,  766,  771,  774,  775,  775,
+      776,  778,  781,  781,  767,  777,  797,  769,  770,  773,
+      780,  774,  784,  797,  782,  780,  785,  784,  776,  782,
+      782,  786,  785,  778,  787,  788,  790,  786,  791,  787,
+      789,  788,  790,  789,  792,  792,  791,  793,  793,  794,
+      795,  796,  798,  799,  799,  800,  796,  794,  801,  802,
+      803,  805,  807,  806,  800,  802,  801,  809,  795,  808,
+      805,  798,  806,  812,  808,  810,  809,  811,  810,  803,
 
-      813,  804,  819,  806,  811,  816,  817,  818,  807,  808,
-      820,  816,  825,  810,  809,  817,  814,  812,  815,  818,
-      821,  819,  822,  823,  820,  826,  821,  827,  823,  824,
-      824,  828,  825,  829,  826,  830,  822,  831,  832,  828,
-      833,  835,  834,  836,  837,  838,  833,  827,  834,  836,
-      841,  838,   53,  829,  839,  835,  831,  830,  832,  840,
-      839,  842,  843,  840,  837,  844,  846,  843,  851,  841,
-      845,  845,  846,  842,  847,  848,  849,  847,  850,  852,
-      852,  842,  853,  856,  850,  854,  844,  859,  851,  849,
-      854,  855,  855,  848,  860,  857,  858,  858,  856,  857,
+      813,  814,  811,  815,  817,  817,  807,  812,  816,  818,
+      814,  819,  820,  816,  816,  821,  815,  822,  825,  825,
+      822,  820,  826,  828,  818,  813,  827,  824,  822,  824,
+      819,  827,  829,  830,  831,  832,  833,  834,  835,  821,
+      836,  838,  835,  826,  828,  833,  837,  838,  839,  840,
+      841,   74,  829,  830,  842,  832,  831,  839,  836,  844,
+      834,  840,  845,  847,  843,  837,  848,  845,  842,  841,
+      843,  846,  846,  844,  849,  848,  850,  851,  852,  853,
+      855,  854,  856,  847,  850,  857,  855,  858,  856,  859,
+      860,  862,  863,  858,  849,  862,  860,  851,  853,  857,
 
-      853,  861,  862,  864,  865,  867,  861,  868,  871,  859,
-      870,  870,  871,   48,  860,  872,  873,  873,  865,  874,
-      875,  862,  876,   43,  875,  867,  878,  864,  868,  869,
-      872,  878,  869,  877,  869,  879,  880,  876,  869,  881,
-      869,  880,  880,  883,  874,  869,  884,  877,  882,  879,
-      869,  884,  882,  881,  885,  886,  887,  888,  883,  889,
-      886,  884,  890,  891,  882,  897,  885,  895,  892,  891,
-      887,  890,  895,  889,  892,  893,  894,  894,  888,  896,
-      898,  893,  899,  901,  902,  896,  904,  897,  906,  902,
-      903,  905,  905,  906,  908,  901,  911,  907,  904,  898,
+      852,  854,  861,  864,  866,  865,  867,  867,  861,  859,
+      865,  863,  868,  869,  870,  864,  869,  871,  868,  873,
+      872,  874,  874,  864,  875,  866,  872,  881,  876,  877,
+      871,  878,  870,  876,  877,  877,  879,  880,  880,  873,
+      879,  882,  875,  883,  884,  886,  878,  889,  883,  881,
+      887,  890,  892,  892,  893,  894,  895,  895,  893,  898,
+      896,  882,  897,  884,  887,  899,  897,  889,  946,  886,
+      894,  946,  890,  891,  898,  900,  891,  901,  891,  899,
+      900,  902,  891,  903,  891,  896,  902,  902,  904,  891,
+      906,  901,  903,  905,  891,  907,  908,  905,  909,  910,
 
-      899,  900,  900,  909,  903,  907,  910,  900,  908,  900,
-      912,  914,  911,  913,  915,  900,  912,  916,  913,  922,
-      900,  900,  909,  917,  917,  910,  923,  900,  918,  914,
-      915,  920,  918,  921,  924,  916,  921,  920,  922,  923,
-      924,  925,  926,  928,  929,  931,  925,  930,  932,  933,
-      934,  931,  928,  929,  935,  934,  936,  932,  937,  938,
-      939,  926,  942,  930,  940,  948,  941,  945,  933,  939,
-      936,  938,  941,  940,  935,  943,  947,  949,  937,  942,
-      950,  943,  951,  945,  952,  948,  953,  954,  957,  958,
-      947,  953,  954,  957,  950,  961,  949,  960,  958,  952,
+      907,  911,  904,  909,  912,  906,  913,  915,  908,  905,
+      907,  914,  915,  910,  916,  913,  919,  914,  912,  917,
+      916,  919,  911,  918,  918,  917,  920,  921,  922,  925,
+      923,  926,  920,  928,  929,  929,  926,  930,  927,  932,
+      933,  925,  930,  934,  935,  928,  931,  922,  923,  921,
+      924,  924,  927,  932,  931,  936,  924,  938,  924,  933,
+      935,  936,  934,  937,  924,  939,  940,  943,  937,  924,
+      924,  941,  941,  942,  945,  938,  924,  942,  947,  948,
+      945,  939,  949,  951,  940,  950,  953,  943,  949,  954,
+      950,  955,  948,  956,  957,  953,  958,  947,  954,  956,
 
-      951,  959,  959,  960,  963,  964,  966,  967,  961,  966,
-      964,  964,  965,  965,  968,  969,  965,  970,  972,  971,
-      963,  967,  973,  974,  975,  976,  980,  981,  973,  980,
-      975,  969,  971,  972,  968,  970,  977,  978,  984,  982,
-      976,  977,  983,  974,  982,  985,  987,  983,  981,  989,
-      985,  978,  986,  990,  984,  989,  991,  986,  987,  992,
-      993,  993,  991,  994,  995,  992,  998,  996,  999,  990,
-      996, 1000,  994,  997,  997, 1001, 1002, 1003, 1001, 1004,
-     1011, 1005,  995, 1003,  998, 1004, 1005,  999, 1006, 1002,
-     1007, 1000, 1008, 1006, 1010, 1007, 1012, 1017, 1008, 1013,
+      959,  960,  951,  957,  961,  959,  962,  955,  963,  970,
+      964,  966,  967,  965,  972,  958,  973,  966,  961,  964,
+      963,  960,  965,  974,  968,  970,  962,  975,  972,  967,
+      968,  976,  977,  978,  979,  982,  973,  983,  978,  979,
+      982,  975,  974,  984,  984,  985,  983,  977,  986,  976,
+      988,  985,  989,  992,  993,  990,  990,  989,  989,  990,
+      991,  986,  994,  991,  995,  997,  988,  992,  996,  998,
+      999, 1000, 1001, 1005,  993,  998, 1005, 1000,  994, 1002,
+      997,  996,  995, 1003, 1002, 1006, 1007, 1001, 1008, 1009,
+      999, 1007, 1012, 1008, 1010, 1011, 1014, 1003, 1015, 1010,
 
-     1011, 1015, 1012, 1018, 1013, 1014, 1014, 1016, 1019, 1021,
-     1015, 1019, 1010, 1022, 1020, 1017, 1016, 1020, 1023, 1024,
-     1021, 1025, 1018, 1026, 1027, 1029, 1029, 1025, 1028, 1026,
-     1023, 1022, 1030, 1028, 1031, 1032, 1033, 1034, 1024, 1027,
-     1033, 1035, 1036, 1037, 1039, 1040, 1040, 1032, 1031, 1043,
-     1035, 1030, 1042, 1044, 1045, 1034, 1047, 1047, 1046, 1045,
-     1048, 1036,   14, 1039, 1043, 1044, 1042, 1046, 1037, 1049,
-     1050, 1052, 1051, 1052, 1053, 1049, 1050, 1051, 1054, 1053,
-     1048, 1055, 1056, 1057, 1058, 1060, 1059, 1056, 1061, 1063,
-     1063, 1064, 1054, 1059, 1065, 1055, 1066, 1068, 1057, 1069,
+     1011, 1016, 1014, 1017, 1012, 1009, 1006, 1016, 1019, 1017,
+     1018, 1018, 1020, 1021, 1015, 1023, 1021, 1019, 1022, 1022,
+     1024, 1025, 1026, 1027, 1030, 1026, 1028, 1035, 1029, 1030,
+     1020, 1036, 1028, 1023, 1029, 1031, 1027, 1032, 1033, 1024,
+     1031, 1025, 1032, 1037, 1033, 1035, 1040, 1038, 1041, 1037,
+     1042, 1036, 1038, 1039, 1039, 1040, 1043, 1041, 1044, 1045,
+     1046, 1044, 1045, 1047, 1048, 1049, 1050, 1051, 1042, 1053,
+     1052, 1046, 1050, 1051, 1053, 1043, 1048, 1054, 1054, 1055,
+     1056, 1047, 1058, 1057, 1049, 1052, 1058, 1059, 1060, 1061,
+     1062, 1064, 1065, 1065, 1056, 1057, 1066, 1060, 1055, 1068,
 
-     1060, 1072, 1067, 1058, 1069, 1064, 1072, 1061, 1067, 1071,
-     1071, 1066, 1065, 1069, 1074, 1069, 1075, 1068, 1069, 1073,
-     1073, 1074, 1076, 1077, 1079, 1076, 1078, 1080, 1081, 1082,
-     1075, 1083, 1080, 1079, 1084, 1085, 1083, 1087, 1087, 1090,
-       13, 1082, 1077, 1088, 1078, 1084, 1089, 1081, 1088, 1092,
-     1091, 1089, 1093, 1092, 1085, 1091, 1094, 1095, 1096, 1090,
-     1098, 1093, 1097, 1099, 1100, 1101, 1102, 1103, 1105, 1106,
-     1099, 1094, 1095, 1104, 1097, 1098, 1100, 1096, 1107, 1104,
-     1109, 1108, 1110, 1105, 1101, 1103, 1112, 1102, 1111, 1106,
-     1108, 1113, 1114, 1116, 1117, 1109, 1118, 1119, 1107, 1116,
+     1070, 1071, 1069, 1073, 1073, 1059, 1071, 1074, 1061, 1072,
+     1064,   68, 1070, 1068, 1075, 1062, 1066, 1069, 1072, 1076,
+     1075, 1077, 1078, 1079, 1078, 1076, 1077, 1074, 1079, 1080,
+     1081, 1082, 1083, 1084, 1085, 1086, 1082, 1087, 1089, 1089,
+     1090, 1085, 1091, 1080, 1081, 1093, 1092, 1083, 1094,   63,
+     1086, 1093, 1084, 1095, 1090, 1097, 1087, 1101, 1095, 1097,
+     1091, 1092, 1098, 1098, 1101, 1099, 1102, 1095, 1094, 1095,
+     1099, 1104, 1095, 1100, 1100, 1103, 1105, 1106, 1103, 1107,
+     1102, 1108, 1110, 1109, 1107, 1111, 1106, 1110, 1113, 1118,
+     1104, 1112, 1115, 1115, 1105, 1109, 1116, 1121, 1117, 1111,
 
-     1111, 1110, 1120, 1121, 1118, 1123, 1113, 1120, 1117, 1124,
-        0, 1112, 1114, 1122, 1125, 1121, 1128, 1119, 1122, 1122,
-     1126, 1126, 1129, 1124, 1123, 1132, 1130, 1125, 1127, 1128,
-     1132, 1129, 1130, 1127, 1131, 1131, 1127, 1127, 1134, 1133,
-     1135, 1127, 1137, 1137, 1134, 1135, 1138, 1127, 1133, 1136,
-     1141, 1127, 1139, 1139, 1136, 1140, 1142, 1143, 1140, 1144,
-     1140, 1146, 1147, 1145, 1150, 1148, 1143, 1138, 1145, 1150,
-     1141, 1148, 1149, 1151, 1142, 1146, 1152, 1151, 1149, 1144,
-     1147, 1153, 1153, 1154, 1154, 1152, 1154, 1155, 1158, 1157,
-     1152, 1159, 1152, 1157, 1152, 1160, 1152, 1163, 1155, 1162,
+     1108, 1116, 1112, 1117, 1120, 1119, 1121, 1113, 1120, 1118,
+     1119, 1122, 1123, 1124, 1126, 1127, 1125, 1129, 1128, 1130,
+     1131, 1134, 1127, 1135, 1133, 1132, 1122, 1123, 1125, 1126,
+     1128, 1132, 1124, 1136, 1137, 1138, 1129, 1140, 1131, 1133,
+     1130, 1134, 1136, 1135, 1139, 1141, 1142, 1144, 1145, 1137,
+     1146, 1147, 1148, 1144, 1138, 1150, 1139, 1152, 1154, 1147,
+     1141, 1153, 1140, 1145, 1146, 1149, 1142, 1150, 1151, 1157,
+     1149, 1154, 1148, 1151, 1151, 1153, 1152, 1155, 1155, 1156,
+     1158, 1161, 1157, 1167, 1156, 1159, 1161, 1156, 1156, 1158,
+     1162, 1159, 1156, 1160, 1160, 1163, 1166, 1166, 1156, 1162,
 
-     1161, 1165, 1164, 1158, 1160, 1161, 1161, 1164, 1162, 1159,
-     1167, 1166, 1168, 1169, 1173, 1165, 1170, 1171, 1171, 1163,
-     1166, 1174, 1170, 1175, 1172, 1176, 1174, 1169, 1173, 1167,
-     1177, 1168, 1172, 1178, 1176, 1179, 1181, 1175, 1180, 1180,
-     1179, 1182, 1182, 1183, 1185, 1183, 1187, 1185, 1177, 1186,
-     1188, 1181, 1189, 1189, 1186, 1190, 1191, 1191, 1178, 1188,
-     1192, 1192, 1193, 1194, 1195, 1187, 1197, 1193, 1196, 1196,
-     1198, 1199, 1200, 1198, 1201, 1190, 1202, 1200, 1202, 1203,
-     1206,    0, 1208, 1201, 1194, 1195, 1197, 1205, 1207, 1209,
-     1205, 1199, 1210, 1207, 1209, 1206, 1208, 1203, 1211, 1212,
+     1164, 1163, 1156, 1165, 1167, 1164, 1168, 1168, 1165, 1169,
+     1170, 1171, 1169, 1172, 1169, 1173, 1174, 1175, 1176, 1177,
+     1178, 1174, 1172, 1179, 1214, 1177, 1178, 1214, 1179, 1171,
+     1170, 1175, 1181, 1180, 1192, 1173, 1176, 1180, 1182, 1182,
+     1184, 1181, 1183, 1183, 1187, 1183, 1181, 1188, 1181, 1186,
+     1181, 1184, 1181, 1186, 1189, 1190, 1192, 1191, 1194, 1187,
+     1190, 1190, 1193, 1189, 1195, 1188, 1191, 1193, 1196, 1197,
+     1198, 1199, 1194, 1195, 1200, 1200, 1202, 1199, 1201, 1204,
+     1203, 1206, 1205, 1207, 1198, 1203, 1201, 1196, 1197, 1208,
+     1202, 1205, 1210, 1204, 1208, 1209, 1209, 1211, 1211, 1206,
 
-     1210, 1213, 1213, 1211, 1212, 1214, 1215, 1216, 1217, 1218,
-     1214, 1220, 1221, 1216, 1222, 1217, 1224, 1220, 1221, 1222,
-     1223, 1225, 1218, 1226, 1215, 1224, 1223, 1227, 1227, 1228,
-     1230, 1231, 1232, 1233, 1226, 1234, 1236, 1237, 1232, 1233,
-     1225, 1234, 1236, 1238, 1239, 1240, 1241, 1242, 1242, 1228,
-     1230, 1237, 1243, 1244, 1231, 1245, 1239, 1237, 1248, 1240,
-     1246, 1247, 1247, 1238, 1241, 1246, 1249, 1251, 1254, 1252,
-     1253, 1249, 1243, 1245, 1252, 1252, 1255, 1254, 1244, 1256,
-     1257, 1248, 1258, 1260, 1255, 1260, 1251, 1261, 1253, 1268,
-     1264, 1259, 1263, 1256, 1264, 1257, 1259, 1258, 1263, 1259,
+     1212, 1215, 1212, 1216, 1217, 1219, 1215, 1210, 1207, 1218,
+     1218, 1220, 1220, 1217, 1221, 1221, 1222, 1223, 1224, 1225,
+     1225, 1222, 1216, 1226, 1227, 1219, 1228, 1227, 1229, 1232,
+     1231, 1230, 1231, 1229, 1234, 1235, 1236, 1234, 1223, 1224,
+     1230, 1236, 1237, 1226, 1238, 1239, 1228, 1232, 1244, 1238,
+     1235, 1295, 1240, 1239, 1241, 1295, 1237, 1240, 1243, 1241,
+     1242, 1242, 1245, 1243, 1246, 1247, 1244, 1249, 1245, 1250,
+     1252, 1246, 1251, 1249, 1253, 1250, 1252, 1251, 1247, 1254,
+     1255, 1256, 1256, 1253, 1257, 1259, 1260, 1261, 1262, 1263,
+     1264, 1255, 1268, 1266, 1262, 1263, 1264, 1267, 1254, 1266,
 
-     1258, 1261, 1265, 1266, 1267, 1270, 1269, 1271, 1266, 1266,
-     1270, 1272, 1271, 1265, 1273, 1268, 1274, 1276, 1280, 1273,
-     1277, 1278, 1280, 1267, 1269, 1279, 1279, 1281, 1282, 1272,
-     1284, 1276, 1285, 1287, 1283, 1286, 1274, 1288, 1277, 1278,
-     1283, 1289, 1284, 1293, 1298, 1281, 1291, 1282, 1287, 1286,
-     1290, 1285, 1288, 1291, 1292, 1290, 1294, 1295, 1295, 1292,
-     1289, 1293, 1296, 1297, 1298, 1294, 1299, 1299, 1300, 1301,
-     1302, 1302, 1297, 1303, 1300, 1304, 1305, 1296, 1306, 1303,
-     1307, 1305, 1314, 1301, 1306, 1313, 1307, 1308, 1308, 1309,
-     1309, 1311, 1311, 1312, 1313, 1315, 1304, 1312, 1316, 1317,
+     1259, 1269, 1270, 1271, 1257, 1273, 1260, 1272, 1272, 1274,
+     1261, 1267, 1268, 1269, 1275, 1276, 1270, 1267, 1277, 1277,
+     1276, 1271, 1278, 1279, 1281, 1273, 1283, 1286, 1279, 1284,
+     1282, 1285, 1275, 1287, 1274, 1282, 1282, 1288, 1284, 1285,
+     1290, 1286, 1289, 1281, 1283, 1278, 1292, 1289, 1287, 1290,
+     1289, 1291, 1288, 1291, 1296, 1288, 1294, 1298, 1297, 1299,
+     1292, 1300, 1294, 1297, 1297, 1296, 1301, 1302, 1303, 1304,
+     1305, 1301, 1302, 1306, 1308, 1305, 1298, 1309, 1310, 1300,
+     1311, 1311, 1313, 1312, 1314, 1299, 1303, 1312, 1308, 1304,
+     1316, 1315, 1317, 1306, 1318, 1309, 1310, 1315, 1319, 1320,
 
-     1314, 1318, 1318, 1319, 1320, 1321, 1317, 1322, 1323, 1315,
-     1321, 1324, 1320, 1316, 1325, 1326, 1324, 1324, 1328, 1325,
-     1325, 1322, 1329, 1319, 1327, 1327, 1331, 1323, 1332, 1330,
-     1333, 1331, 1337, 1334, 1335, 1326, 1338, 1328, 1330, 1336,
-     1335, 1329, 1338, 1339, 1336, 1342, 1340, 1332, 1341, 1343,
-     1333, 1334, 1340, 1344, 1341, 1345, 1346, 1347, 1337, 1351,
-     1348,    0, 1339, 1355, 1342, 1349, 1349, 1355, 1343, 1361,
-     1346, 1351, 1344, 1350, 1345, 1348, 1350, 1356, 1347, 1352,
-     1352, 1353, 1353, 1354, 1357, 1358, 1363, 1361, 1354, 1359,
-     1356, 1359, 1362, 1357, 1364, 1359, 1365, 1362, 1358, 1366,
+     1313, 1321, 1316, 1314, 1322, 1323, 1325, 1326, 1318, 1322,
+     1324, 1317, 1323, 1319, 1320, 1324, 1326, 1327, 1327, 1328,
+     1321, 1329, 1330, 1332, 1325, 1331, 1331, 1333, 1336, 1332,
+     1329, 1334, 1334, 1335, 1328, 1337, 1341, 1341, 1338, 1335,
+     1339, 1333, 1330, 1338, 1336, 1340, 1339, 1342, 1342, 1344,
+     1344, 1340, 1346, 1345, 1347, 1348, 1337, 1345, 1349, 1350,
+     1352, 1346, 1351, 1351, 1355, 1354, 1350, 1353, 1356, 1348,
+     1354, 1357, 1347, 1349, 1359, 1353, 1357, 1357, 1355, 1358,
+     1352, 1360, 1360, 1361, 1358, 1358, 1362, 1356, 1363, 1365,
+     1364, 1366, 1367, 1368, 1359, 1364, 1369, 1363, 1370, 1368,
 
-     1366, 1363, 1367, 1368, 1369, 1370, 1371, 1367, 1359, 1368,
-     1374, 1371, 1365, 1372, 1364, 1375, 1373, 1372, 1370, 1369,
-     1373, 1376, 1377, 1378, 1378, 1380, 1382, 1383, 1377, 1386,
-     1374, 1385, 1383, 1375, 1384, 1384, 1392, 1385, 1388, 1388,
-     1393, 1376, 1390, 1380, 1396, 1390, 1397, 1382, 1399, 1386,
-     1391, 1391, 1392, 1400, 1395, 1397, 1393, 1395, 1398, 1398,
-     1401, 1402, 1403, 1399, 1396, 1406, 1402, 1404, 1404, 1405,
-     1407, 1408, 1409, 1409, 1400, 1410, 1403, 1411, 1405, 1401,
-     1415, 1412, 1413, 1406, 1415, 1407, 1412, 1414, 1414, 1410,
-     1416, 1417, 1417, 1418, 1419, 1411, 1408, 1413, 1420, 1421,
+     1371, 1369, 1361, 1372, 1375, 1362, 1371, 1373, 1365, 1374,
+     1367, 1366, 1376, 1373, 1377, 1374, 1378, 1380, 1379, 1381,
+     1382, 1382, 1372, 1375, 1370, 1383,   58, 1384, 1383, 1385,
+     1385, 1376, 1379, 1377, 1381, 1378, 1386, 1386, 1380, 1384,
+     1387, 1389, 1388, 1390, 1391, 1387, 1388, 1392, 1396, 1392,
+     1394, 1395, 1390, 1392, 1389, 1397, 1395, 1391, 1398, 1399,
+     1399, 1402, 1400, 1396, 1401, 1403, 1392, 1400, 1394, 1405,
+     1401, 1407, 1404, 1405, 1398, 1397, 1402, 1404, 1403, 1406,
+     1408, 1409, 1410, 1406, 1411, 1411, 1413, 1415, 1410, 1416,
+     1418, 1407, 1417, 1417, 1416, 1419, 1418, 1425, 1408, 1421,
 
-     1426, 1422, 1420, 1424, 1424, 1419, 1422, 1425, 1427, 1428,
-     1416, 1429, 1430, 1430, 1426, 1418, 1431, 1432, 1421, 1433,
-     1434, 1431, 1436, 1428, 1440, 1425, 1435, 1427, 1427, 1434,
-     1437, 1435, 1437, 1438, 1439, 1441, 1429, 1432, 1438, 1433,
-     1439, 1441, 1436, 1443, 1440, 1444, 1444, 1445, 1446, 1449,
-     1448, 1450, 1450, 1452, 1446, 1448, 1453, 1443, 1451, 1451,
-     1454, 1455, 1456, 1456, 1455, 1457, 1445, 1452, 1458,    0,
-     1466, 1476, 1460, 1449, 1453, 1454, 1459, 1457, 1460, 1459,
-     1461, 1462, 1459, 1464, 1462, 1461, 1465, 1467, 1458, 1476,
-     1467, 1465, 1464, 1469, 1459, 1466, 1468, 1468, 1470, 1469,
+     1421, 1409, 1423, 1426, 1413, 1423, 1424, 1424, 1415, 1428,
+     1429, 1430, 1428, 1425, 1432, 1419, 1431, 1431, 1433, 1426,
+     1430, 1434, 1435, 1436, 1437, 1437, 1438, 1435, 1439, 1432,
+     1429, 1441, 1440, 1442, 1442, 1438, 1443, 1436, 1445, 1433,
+     1434, 1444, 1446, 1445, 1447, 1447, 1439, 1440, 1448, 1449,
+     1443, 1451, 1448, 1450, 1450, 1452, 1441, 1446, 1453, 1444,
+     1454, 1458, 1453, 1455, 1457, 1457, 1452, 1459, 1455, 1449,
+     1460, 1461, 1462, 1451, 1463, 1464, 1464, 1458, 1465, 1454,
+     1466, 1467, 1470, 1465, 1460, 1459, 1462, 1468, 1469, 1473,
+     1461, 1461, 1471, 1469, 1471, 1473, 1468, 1474, 1472, 1463,
 
-     1462, 1471, 1471, 1470, 1472, 1472, 1473, 1475, 1474, 1477,
-     1478, 1479, 1473, 1474, 1479, 1480, 1481, 1484, 1482, 1483,
-     1475, 1480, 1481, 1482, 1485, 1483, 1486, 1486, 1477, 1485,
-     1478, 1487, 1488, 1489, 1490, 1491, 1487, 1492, 1493, 1494,
-     1484, 1495, 1496, 1497, 1496, 1502, 1499, 1500, 1503, 1491,
-     1488, 1492, 1493, 1489, 1490, 1501, 1504, 1494, 1499, 1505,
-     1500, 1501, 1497, 1507, 1507, 1502, 1495, 1508, 1503, 1509,
-     1504, 1510, 1510, 1511, 1509, 1512, 1513, 1514, 1516, 1517,
-     1505, 1515, 1518, 1519, 1523,    0, 1517, 1508, 1511, 1512,
-     1515, 1518, 1521, 1516, 1518, 1514, 1525, 1525, 1524, 1519,
+     1466, 1467, 1470, 1472, 1475, 1477, 1478, 1478, 1479, 1480,
+     1475, 1482, 1483, 1484, 1484, 1480, 1482, 1474, 1486, 1477,
+     1485, 1485, 1487, 1488, 1491, 1489, 1493, 1479, 1489, 1490,
+     1490, 1492, 1486, 1495, 1497, 1501, 1483, 1497, 1488, 1495,
+     1487, 1494, 1491, 1492, 1494, 1496, 1493, 1494, 1499, 1500,
+     1496, 1506, 1502, 1497, 1500, 1502, 1506, 1499, 1504, 1494,
+     1501, 1503, 1503, 1505, 1504, 1507, 1507, 1508, 1508, 1505,
+     1509, 1511, 1510, 1512, 1513, 1514, 1509, 1510, 1515, 1516,
+     1517, 1515, 1518, 1519, 1511, 1516, 1517, 1518, 1520, 1519,
+     1524, 1512, 1521, 1513, 1525, 1514, 1523, 1521, 1522, 1522,
 
-     1513, 1524, 1526, 1526, 1527, 1528, 1531, 1521, 1529, 1523,
-     1532, 1529, 1521, 1530, 1530, 1533, 1527, 1534, 1535, 1531,
-     1533, 1537, 1534, 1528, 1536, 1538, 1539, 1540, 1541, 1532,
-     1537, 1542, 1542, 1543, 1541, 1539, 1540, 1535, 1539, 1544,
-     1536, 1545, 1546, 1548, 1538, 1547, 1551, 1552, 1553, 1553,
-     1554, 1555, 1544, 1543, 1560, 1548, 1546, 1556, 1558, 1545,
-     1555, 1547, 1556, 1557, 1557, 1552, 1554, 1558, 1559, 1561,
-     1558, 1551, 1560, 1559, 1562, 1563, 1567, 1565, 1557, 1566,
-     1563, 1563, 1568, 1569, 1570, 1571, 1571, 1568, 1577, 1569,
-     1561, 1565, 1562, 1572, 1566, 1573, 1578, 1574, 1567, 1572,
+     1526, 1523, 1527, 1528, 1529, 1530, 1531, 1532, 1524, 1532,
+     1533, 1520, 1535, 1536, 1525, 1537, 1527, 1528, 1529, 1539,
+     1526, 1538, 1540, 1530, 1535, 1536, 1541, 1538, 1537, 1533,
+     1542, 1531, 1544, 1544, 1545, 1548, 1546, 1547, 1547, 1539,
+     1541, 1546, 1540, 1549, 1550, 1551, 1552, 1553, 1564, 1554,
+     1548, 1542, 1555, 1556, 1545, 1552, 1554, 1549, 1558, 1560,
+     1564, 1555, 1553, 1551, 1555, 1562, 1562, 1561, 1550, 1556,
+     1561, 1563, 1563, 1558, 1565, 1568, 1566, 1569, 1558, 1566,
+     1567, 1567, 1570, 1572, 1560, 1571, 1574, 1570, 1568, 1573,
+     1571, 1575, 1565, 1578, 1576, 1574, 1569, 1580, 1577, 1578,
 
-     1573, 1575, 1570, 1574, 1580, 1579, 1581, 1575, 1577, 1581,
-     1578, 1579, 1582, 1584, 1586, 1581, 1587, 1580, 1582, 1588,
-     1589, 1584, 1595, 1590, 1591, 1592, 1593, 1588, 1595, 1589,
-     1594, 1594, 1596, 1586, 1597, 1587, 1590, 1591, 1596, 1592,
-     1593, 1598, 1598, 1599, 1600, 1601, 1602, 1597, 1603, 1604,
-     1605, 1606, 1594, 1609, 1603, 1608, 1608, 1610, 1615, 1602,
-     1611, 1610, 1600, 1599, 1601, 1611, 1605, 1612, 1614, 1606,
-     1613, 1604, 1612, 1609, 1617, 1613, 1619, 1614, 1618, 1618,
-     1620, 1615, 1621, 1622, 1622, 1623, 1624, 1627, 1625, 1617,
-     1626, 1628, 1620, 1624, 1631, 1619, 1630, 1629, 1632, 1623,
+     1579, 1579, 1572, 1576, 1582, 1573, 1576, 1577, 1581, 1583,
+     1575, 1584, 1585, 1588, 1589, 1590, 1590, 1580, 1591, 1592,
+     1593, 1581, 1582, 1583, 1585, 1593, 1598, 1584, 1592, 1594,
+     1594, 1595, 1589, 1597, 1591, 1599, 1596, 1603, 1588, 1604,
+     1595, 1596, 1602, 1595, 1594, 1605, 1607, 1598,   57, 1600,
+     1605, 1597, 1603, 1599, 1600, 1600, 1602, 1606, 1608, 1608,
+     1609, 1604, 1610, 1606, 1607, 1611, 1609, 1610, 1612, 1614,
+     1615, 1611, 1616, 1617, 1612, 1619, 1618, 1623, 1616, 1618,
+     1621, 1619, 1624, 1625, 1615, 1618, 1617, 1627, 1621, 1614,
+     1626, 1625, 1628, 1629, 1630, 1637, 1623, 1631, 1631, 1626,
 
-     1625, 1621, 1626, 1629, 1632, 1642, 1627, 1642, 1630, 1633,
-     1633, 1628, 1631, 1634, 1635, 1635, 1634, 1637, 1638, 1639,
-     1640, 1640, 1637, 1641, 1644, 1639, 1643, 1638, 1645, 1643,
-     1646, 1647, 1648, 1649, 1650, 1641, 1651, 1648, 1652, 1654,
-     1657, 1659, 1649, 1652, 1644, 1653, 1650, 1659, 1646, 1647,
-     1645, 1651, 1655, 1656, 1653, 1657, 1660, 1655, 1656, 1654,
-     1658, 1658, 1662, 1663, 1655, 1664, 1665, 1653, 1665, 1670,
-     1666, 1667, 1667, 1668, 1668, 1669, 1669, 1660, 1673, 1663,
-     1674, 1662, 1671, 1671, 1666, 1664, 1666, 1672, 1672, 1670,
-     1675, 1675, 1676, 1681, 1677, 1678, 1676, 1680, 1678, 1673,
+     1627, 1624, 1634, 1632, 1633, 1628, 1636, 1629, 1630, 1632,
+     1633, 1635, 1635, 1637, 1638, 1634, 1639, 1640, 1641, 1631,
+     1642, 1643, 1646, 1640, 1645, 1645, 1636, 1647, 1652, 1639,
+     1648, 1647, 1649, 1638, 1654, 1648, 1642, 1649, 1650, 1643,
+     1641, 1651, 1646, 1650, 1655, 1657, 1654, 1656, 1656, 1658,
+     1651, 1652, 1659, 1660, 1660, 1661, 1662, 1665, 1663, 1655,
+     1664, 1658, 1666, 1662, 1657, 1668, 1669, 1667, 1670, 1661,
+     1663, 1659, 1664, 1667, 1670,   52, 1665, 1668, 1671, 1671,
+     1672, 1676, 1666, 1672, 1669, 1673, 1673, 1675, 1677, 1679,
+     1676, 1680, 1675, 1680, 1677, 1678, 1678, 1681, 1682, 1683,
 
-     1677, 1674, 1682, 1680, 1683, 1686, 1684, 1689, 1682, 1684,
-     1687, 1681, 1685, 1685, 1690, 1687, 1688, 1688, 1692, 1690,
-     1691, 1691, 1693, 1694, 1692, 1686, 1695, 1696, 1689, 1683,
-     1697, 1700, 1699, 1696, 1693, 1693, 1693, 1699, 1699, 1703,
-     1701, 1693, 1701, 1694, 1702, 1700, 1695, 1704, 1705, 1706,
-     1697, 1707, 1709, 1704, 1703, 1702, 1711, 1705, 1708, 1708,
-     1710, 1710, 1712, 1713, 1713, 1714, 1714, 1715, 1719, 1706,
-     1718, 1718, 1707, 1720, 1722, 1723, 1711, 1726, 1709, 1724,
-     1725, 1725, 1720, 1722, 1712, 1724, 1727, 1715, 1728, 1730,
-     1729, 1731, 1731, 1719, 1732, 1728, 1723, 1733, 1726, 1729,
+     1681, 1679, 1684, 1686, 1685, 1687, 1688, 1689, 1686, 1690,
+     1687, 1691, 1693, 1696, 1692, 1688, 1691, 1699, 1682, 1689,
+     1684, 1683, 1685, 1692, 1690, 1694, 1695, 1701, 1696, 1698,
+     1694, 1695, 1693, 1697, 1697, 1698, 1692, 1694, 1699, 1702,
+     1703, 1704, 1705, 1710, 1705,   47, 1701, 1713, 1706, 1707,
+     1707, 1708, 1708, 1709, 1709, 1714, 1703, 1711, 1711, 1702,
+     1723, 1704, 1706, 1710, 1706, 1712, 1712, 1716, 1713, 1715,
+     1715, 1716, 1717, 1720, 1718, 1721, 1714, 1718, 1717, 1720,
+     1722, 1724, 1725, 1725, 1724, 1723, 1722, 1726, 1729, 1727,
+     1728, 1728, 1730, 1721, 1727, 1731, 1731, 1730, 1732, 1733,
 
-     1735, 1727, 1736, 1737, 1738, 1735, 1739, 1744, 1736, 1742,
-     1740, 1738, 1739, 1733, 1742, 1730, 1740, 1741, 1741, 1743,
-     1732, 1745, 1746, 1737, 1748, 1749, 1747, 1744, 1743, 1747,
-     1750, 1750, 1751, 1752, 1746, 1753, 1757, 1754, 1751, 1752,
-     1745, 1755, 1748, 1758, 1759, 1755, 1760, 1760, 1761, 1759,
-     1764, 1749, 1754, 1762, 1765, 1753, 1757, 1766, 1765, 1768,
-     1768, 1755, 1767, 1766, 1770, 1758, 1769, 1761, 1762, 1764,
-     1769, 1767, 1771, 1771, 1772, 1770, 1773, 1774, 1775, 1776,
-     1770, 1777, 1778, 1775, 1780, 1779, 1781, 1781, 1778, 1780,
-     1773, 1782, 1782, 1783, 1785, 1772, 1774, 1783, 1786, 1776,
+     1734, 1735, 1736, 1732, 1737, 1733, 1738, 1726, 1747, 1729,
+     1737, 1740, 1734, 1734, 1734, 1741, 1740, 1740, 1742, 1734,
+     1742, 1735, 1736, 1743, 1744, 1745, 1738, 1746, 1747, 1741,
+     1748, 1745, 1749, 1749, 1743, 1750, 1746, 1751, 1751, 1744,
+     1752, 1753, 1754, 1754, 1755, 1755, 1756, 1759, 1759, 1760,
+     1761, 1748, 1764, 1763, 1766, 1766, 1767, 1768, 1765, 1761,
+     1752, 1750, 1763, 1753, 1765, 1771, 1756, 1770, 1769, 1772,
+     1772, 1773, 1768, 1764, 1760, 1769, 1770, 1767, 1774, 1776,
+     1777, 1778, 1779, 1783, 1776, 1785, 1777, 1780, 1783, 1779,
+     1781, 1771, 1786, 1780, 1774, 1784, 1781, 1773, 1782, 1782,
 
-     1779, 1777, 1787, 1785, 1788, 1788, 1790, 1790, 1794, 1786,
-     1791, 1792, 1793, 1796, 1786, 1791, 1791, 1792, 1793, 1795,
-     1797, 1799, 1787, 1800, 1795, 1796, 1797, 1800, 1801, 1802,
-     1803, 1804, 1805, 1799, 1794, 1806, 1803, 1808, 1805, 1809,
-     1801, 1810, 1812, 1813, 1813, 1812, 1810, 1806, 1816, 1808,
-     1814, 1814,    0, 1804, 1802, 1815, 1815, 1817, 1809, 1818,
-     1821, 1819, 1823, 1817, 1820, 1818, 1819, 1823, 1816, 1821,
-     1820, 1825, 1826, 1829, 1825, 1827, 1827, 1830, 1831, 1832,
-     1832, 1833, 1834, 1831, 1826, 1829, 1835, 1834, 1837, 1830,
-     1833, 1835, 1836, 1836, 1838, 1839, 1840, 1841, 1844, 1842,
+     1787, 1778, 1789, 1788, 1784, 1785, 1788, 1790, 1791, 1791,
+     1792, 1786, 1787, 1793, 1794, 1795, 1792, 1796, 1798, 1793,
+     1789, 1796, 1799, 1800, 1801, 1801, 1802, 1803, 1800, 1805,
+     1795, 1806, 1808, 1790, 1794, 1806, 1811, 1796, 1798, 1810,
+     1807, 1808, 1803, 1810, 1799, 1802, 1807, 1811, 1805, 1809,
+     1809, 1813, 1811, 1812, 1812, 1814, 1815, 1816, 1817, 1818,
+     1819, 1820, 1816, 1821, 1822, 1822, 1819, 1828, 1821, 1814,
+     1823, 1823, 1813, 1824, 1826, 1815, 1820, 1824, 1817, 1818,
+     1827, 1829, 1829, 1826, 1831, 1831, 1833, 1828, 1832, 1834,
+     1835, 1827, 1833, 1832, 1832, 1834, 1827, 1836, 1837, 1838,
 
-     1843, 1841, 1845, 1838, 1842, 1846, 1843, 1847, 1837, 1850,
-     1851, 1845, 1855, 1839, 1854, 1840, 1844, 1849, 1849, 1851,
-        0, 1847, 1853, 1846, 1852, 1852, 1854, 1850, 1857, 1849,
-     1856, 1853, 1863, 1855, 1864, 1856, 1860, 1860, 1866, 1862,
-     1867, 1857, 1862, 1868, 1869, 1870, 1870,    0, 1863, 1868,
-     1864, 1872, 1872, 1866, 1867, 1871, 1873, 1871, 1875, 1875,
-     1878, 1869, 1876, 1876, 1873, 1879, 1878, 1880, 1881, 1882,
-     1882, 1879, 1883, 1884, 1880, 1885, 1888, 1886, 1887, 1890,
-     1889, 1883, 1895, 1892, 1893, 1890, 1896, 1885, 1881, 1886,
-     1887, 1894, 1894, 1899, 1884, 1889, 1893, 1902, 1890, 1902,
+     1840, 1842, 1836, 1841, 1843, 1838, 1845, 1841, 1844, 1846,
+     1837, 1848, 1840, 1842, 1844, 1846, 1835, 1847, 1850, 1851,
+     1852, 1854, 1847, 1848, 1854, 1852, 1855, 1855, 1845, 1843,
+     1850, 1856, 1856, 1857, 1857, 1858, 1859, 1860, 1851, 1861,
+     1862, 1863, 1859, 1860, 1861, 1867, 1862, 1865, 1867, 1868,
+     1863, 1871, 1865, 1869, 1869, 1858, 1872, 1873, 1874, 1874,
+     1875, 1868, 1873, 1871, 1878, 1876, 1877, 1878, 1872, 1875,
+     1876, 1877, 1879, 1879, 1880, 1881, 1884, 1882, 1883, 1886,
+     1884, 1885, 1887, 1888, 1881, 1886, 1885, 1889, 1890, 1892,
+     1892, 1893, 1888, 1899, 1880, 1882,   18, 1883, 1894, 1897,
 
-     1895, 1897, 1888, 1892, 1897, 1898, 1896, 1901, 1903, 1904,
-     1898, 1905, 1901, 1899, 1904, 1907, 1909, 1911, 1905, 1910,
-     1912, 1913, 1912, 1915, 1907, 1915, 1903, 1916, 1910, 1911,
-     1917, 1917, 1918, 1919, 1909, 1920, 1923, 1920, 1919, 1921,
-     1913, 1916, 1922, 1924, 1921, 1925, 1927, 1922, 1926, 1928,
-     1930, 1925, 1931, 1926, 1923, 1932, 1932, 1928, 1918, 1927,
-     1933, 1933, 1934, 1924, 1935, 1936, 1931, 1937, 1938, 1930,
-     1938, 1936, 1937, 1939, 1940, 1941, 1941, 1934, 1943, 1943,
-     1942, 1947, 1940, 1946, 1935, 1944, 1944, 1945, 1946, 1949,
-     1940, 1939, 1942, 1950, 1951, 1950, 1945, 1952, 1949, 1947,
+     1887, 1892, 1890, 1895, 1895, 1889, 1898, 1894, 1897, 1893,
+     1896, 1896, 1900, 1901, 1899, 1904, 1904, 1900, 1898, 1906,
+     1907, 1908, 1906, 1910, 1912, 1911, 1901, 1913, 1914, 1914,
+     1912, 1915, 1917, 1915, 1916, 1916, 1907, 1908, 1910, 1911,
+     1917, 1919, 1919, 1922, 1913, 1920, 1920, 1923, 1924, 1922,
+     1925, 1926, 1928, 1923, 1929, 1924, 1927, 1927, 1930, 1933,
+     1935, 1928, 1931, 1934, 1932, 1938, 1935, 1937, 1939, 1939,
+     1930, 1926, 1925, 1940, 1931, 1929, 1932, 1938, 1934, 1935,
+     1941, 1942, 1944, 1943, 1942, 1933, 1948, 1937, 1943, 1946,
+     1947, 1940, 1947, 1949, 1946, 1954, 1950, 1952, 1949, 1955,
 
-     1953, 1949, 1952, 1952, 1954, 1956, 1957, 1958, 1960, 1953,
-     1961, 1957, 1958, 1962, 1964, 1951, 1954, 1956, 1963, 1963,
-     1965, 1960, 1962, 1966, 1970, 1971, 1967, 1968, 1972, 1973,
-     1961, 1981, 1964, 1984, 1973, 1975, 1970, 1971, 1965, 1966,
-     1967, 1974, 1968, 1978, 1975, 1980, 1974, 1985, 1972, 1978,
-     1982, 1980, 1983, 1989, 1981, 1987, 1985, 1990, 1984, 1986,
-     1986, 1990, 1978, 1991, 1987, 1982, 1988, 1988, 1991, 1992,
-     1983, 1993, 1989, 1994, 1995, 1996, 1993, 1993, 1996, 1994,
-     1995, 1997, 1992, 1998, 2001, 2001, 2002, 2002, 2003, 1997,
-     2004, 2004, 2005, 2005, 2006, 2007, 2008, 2003, 2019, 2009,
+     1941, 1958, 1944, 1950, 1948, 1956, 1952, 1957, 1955, 1957,
+     1960, 1961, 1960, 1954, 1962, 1962, 1963, 1956, 1964, 1965,
+     1958, 1965, 1966, 1964, 1967, 1961, 1968, 1966, 1969, 1967,
+     1970, 1973, 1971, 1972, 1975, 1976, 1970, 1971, 1984, 1973,
+     1977, 1977, 1963, 1979, 1968, 1980, 1972, 1982, 1969, 1976,
+     1978, 1978, 1982, 1975, 1981, 1983, 1984, 1983, 1979, 1985,
+     1981, 1986, 1986, 1990, 1987, 1980, 1992, 1985, 1988, 1988,
+     1989, 1989, 1990, 1991, 1994, 1985, 1987, 1995, 1991, 1995,
+     1996, 1998, 1997, 1994, 1992, 1999, 1994, 1997, 1997, 2002,
+     1998, 2001, 2005, 2003, 2002, 2006, 2009, 1999, 2003, 2007,
 
-     2012, 2002, 2008, 1998, 2009, 2012, 2006, 2010, 2010, 2011,
-     2011, 2013, 2002, 2007, 2015, 2016, 2017, 2013, 2015, 2020,
-     2017, 2021, 2022, 2019, 2020, 2023, 2025, 2024, 2026, 2027,
-     2023, 2028, 2029, 2029, 2027, 2016, 2030, 2022, 2032, 2031,
-     2030, 2033, 2025, 2032, 2021, 2024, 2034, 2035, 2026, 2037,
-     2036, 2038, 2041, 2028, 2031, 2036, 2039, 2039, 2034, 2042,
-     2041, 2043, 2037, 2044, 2045, 2046, 2035, 2033, 2047, 2038,
-     2048, 2049, 2051, 2054, 2055, 2095, 2055, 2053, 2042, 2054,
-     2043, 2095, 2048, 2058, 2046, 2059, 2044, 2051, 2045, 2047,
-     2053, 2060, 2049, 2056, 2056, 2057, 2058, 2064, 2057, 2059,
+     2010, 1996, 2012, 2001, 2011, 2005, 2008, 2008, 2007, 2013,
+     2015, 2016, 2017, 2026, 2009, 2006, 2012, 2029, 2010, 2020,
+     2011, 2018, 2015, 2016, 2013, 2019, 2018, 2023, 2020, 2025,
+     2019, 2030, 2017, 2023, 2027, 2025, 2026, 2028, 2031, 2031,
+     2030, 2032, 2029, 2033, 2033, 2034, 2023, 2035, 2036, 2027,
+     2032, 2035, 2037, 2036, 2038, 2028, 2039, 2040, 2044, 2049,
+     2041, 2039, 2039, 2040, 2034, 2037, 2041, 2042, 2049, 2043,
+     2042, 2047, 2047, 2048, 2048, 2052, 2038, 2043, 2044, 2050,
+     2050, 2051, 2051, 2053, 2054, 2061, 2055, 2052, 2048, 2061,
+     2054, 2055, 2056, 2056, 2057, 2057, 2062, 2058, 2059, 2048,
 
-     2061, 2061, 2062, 2062, 2060, 2063, 2063, 2065, 2066, 2066,
-     2067, 2069, 2064, 2068, 2068, 2072, 2069, 2073, 2071, 2067,
-     2065, 2074, 2067, 2071, 2075, 2075, 2076, 2076, 2077, 2078,
-     2078, 2079, 2085, 2074, 2088, 2072, 2081, 2073, 2080, 2080,
-     2082, 2083, 2083, 2084, 2084, 2082, 2085, 2077, 2086, 2079,
-     2087, 2081, 2092, 2088, 2090, 2091, 2091, 2086, 2094, 2090,
-     2093, 2093, 2096, 2100, 2087, 2096, 2097, 2097, 2098, 2098,
-     2099, 2092, 2101, 2102, 2102, 2104, 2094, 2105, 2100, 2106,
-     2107, 2111, 2097, 2109, 2107, 2108, 2108, 2110, 2112, 2099,
-     2115, 2101, 2110, 2117, 2106, 2104, 2111, 2114, 2114, 2116,
+     2064, 2053, 2058, 2063, 2059, 2066, 2067, 2063, 2068, 2069,
+     2070, 2067, 2072, 2073, 2071, 2070, 2062, 2074, 2075, 2077,
+     2064, 2078, 2074, 2077, 2069, 2076, 2076, 2080, 2072, 2079,
+     2066, 2068, 2071, 2073, 2079, 2081, 2078, 2082, 2083, 2084,
+     2075, 2085, 2081, 2086, 2084, 2087, 2087, 2089, 2090, 2082,
+     2091, 2092, 2093, 2080, 2085, 2089, 2094, 2083, 2095, 2096,
+     2097, 2086, 2099,   17, 2102, 2101, 2103, 2090, 2103, 2091,
+     2102, 2096, 2104, 2104, 2092, 2094, 2093, 2099, 2101, 2095,
+     2105, 2097, 2107, 2106, 2108, 2105, 2106, 2109, 2110, 2110,
+     2111, 2111, 2112, 2112, 2113, 2107, 2116, 2114, 2108, 2121,
 
-     2105, 2118, 2109, 2112, 2119, 2120, 2116, 2117, 2121, 2121,
-     2115, 2122, 2123, 2126, 2123, 2124, 2127, 2129, 2124, 2118,
-     2122, 2127, 2119, 2128, 2130, 2126, 2131, 2132, 2128, 2133,
-     2137, 2120, 2132, 2124, 2135, 2124, 2136, 2130, 2138, 2135,
-     2139, 2136, 2129, 2140, 2138, 2137, 2141, 2131, 2142, 2140,
-     2143, 2141, 2144, 2142, 2145, 2133, 2150, 2145, 2146, 2147,
-     2148, 2139, 2149, 2155,    0, 2144, 2151, 2146, 2147, 2148,
-     2150, 2149, 2151, 2152, 2153, 2143, 2157, 2161, 2153, 2152,
-     2158, 2158, 2159, 2155, 2163, 2157, 2160, 2160, 2159, 2164,
-     2165, 2165, 2166, 2167, 2169, 2160, 2170, 2161, 2171, 2161,
+     2109, 2115, 2115, 2117, 2117, 2116, 2118, 2120, 2116, 2113,
+     2114, 2118, 2120, 2122, 2123, 2124, 2124, 2125, 2125, 2121,
+     2126, 2127, 2127, 2128, 2129, 2129, 2123, 2130, 2135, 2131,
+     2132, 2132, 2134, 2122, 2131, 2133, 2133, 2135, 2136, 2126,
+     2137, 2128, 2130, 2139, 2140, 2140, 2134, 2141, 2139, 2142,
+     2142, 2143, 2136, 2145, 2144, 2148, 2145, 2146, 2146, 2137,
+     2144, 2147, 2147, 2149, 2150, 2153, 2141, 2151, 2151, 2143,
+     2154, 2155, 2156, 2146, 2148, 2158, 2156, 2159, 2149, 2157,
+     2157, 2160, 2159, 2150, 2161, 2153, 2155, 2163, 2163, 2164,
+     2165, 2166, 2167, 2154, 2158, 2168, 2160, 2165, 2169, 2161,
 
-     2163, 2174, 2167, 2172, 2174, 2164, 2169, 2166, 2176, 2175,
-     2177,    0, 2170, 2171, 2175, 2172, 2178, 2178, 2179, 2179,
-     2181, 2181, 2177, 2182, 2183, 2184, 2182, 2185, 2176, 2183,
-     2187, 2184, 2190, 2185, 2186, 2186, 2188, 2188, 2189, 2191,
-     2192, 2192, 2193, 2194, 2187, 2197, 2190, 2195, 2193, 2197,
-     2189, 2198, 2195, 2201, 2198, 2199, 2199, 2194, 2191, 2200,
-     2202, 2203, 2201, 2205, 2200, 2203, 2204, 2204, 2207, 2208,
-     2209, 2210, 2212, 2207, 2211, 2214, 2205, 2213, 2211, 2216,
-     2202, 2214, 2213, 2217, 2219, 2210, 2218, 2215, 2221, 2208,
-     2209, 2218, 2212, 2215, 2222, 2223, 2228, 2216, 2224, 2222,
+     2170, 2170, 2171, 2176, 2172, 2166, 2172, 2175, 2176, 2164,
+     2167, 2171, 2173, 2168, 2178, 2173, 2177, 2180, 2179, 2175,
+     2181, 2177, 2182, 2184, 2169, 2181, 2186, 2187, 2184, 2185,
+     2173, 2179, 2173, 2187, 2185, 2188, 2189, 2192, 2180, 2178,
+     2190, 2186, 2189, 2195, 2191, 2190, 2193, 2194, 2182, 2191,
+     2194, 2196, 2195, 2199, 2197, 2198, 2188, 2202, 2204, 2193,
+     2196, 2202, 2192, 2197, 2198, 2200, 2201, 2199, 2206, 2207,
+     2207, 2200, 2201, 2208, 2209, 2209, 2210, 2206, 2204, 2208,
+     2211, 2210, 2213, 2209, 2216, 2214, 2215, 2215, 2217, 2220,
+     2224, 2219, 2221, 2224, 2222, 2226, 2227, 2217, 2213, 2216,
 
-     2230, 2223, 2217, 2230, 2221, 2219, 2224, 2225, 2231, 2225,
-     2228, 2229, 2229, 2232, 2232, 2234, 2235, 2236, 2238, 2234,
-     2237, 2237, 2235, 2241, 2241, 2243, 2245, 2238, 2246, 2236,
-     2249, 2250, 2251, 2252, 2231, 2249, 2259, 2251, 2252, 2260,
-     2245, 2253, 2253, 2243, 2246, 2255, 2255, 2257, 2258, 2258,
-     2261, 2263, 2259, 2257, 2264, 2261, 2267, 2250, 2265, 2265,
-     2269, 2260, 2268, 2274, 2270, 2267, 2264, 2275, 2268, 2280,
-     2263, 2272, 2272, 2273, 2277, 2277, 2273, 2281, 2269, 2270,
-     2278, 2278, 2274, 2279, 2282, 2275, 2281, 2280, 2279, 2282,
-     2283, 2284, 2283, 2285, 2286, 2287, 2288, 2289, 2290, 2290,
+     2211, 2214, 2211, 2219, 2225, 2220, 2222, 2221, 2227, 2225,
+     2228, 2228, 2229, 2229, 2233, 2226, 2231, 2231, 2232, 2233,
+     2234, 2232, 2235, 2236, 2237, 2237, 2234, 2238, 2235, 2239,
+     2239, 2240, 2236, 2241, 2242, 2243, 2243, 2245, 2244, 2253,
+     2246, 2238, 2248, 2240, 2244, 2246, 2248, 2241, 2253, 2249,
+     2254, 2245, 2249, 2242, 2250, 2250, 2251, 2252, 2252, 2255,
+     2257, 2251, 2259, 2255, 2256, 2256, 2260, 2259, 2261, 2262,
+     2254, 2263, 2264, 2257, 2265, 2263, 2266, 2268, 2267, 2265,
+     2269, 2271, 2266, 2262, 2267, 2270, 2260, 2274, 2261, 2273,
+     2270, 2275, 2264, 2281, 2276, 2268, 2275, 2277, 2284, 2269,
 
-     2287, 2294, 2289, 2291, 2291, 2284, 2286, 2285, 2292, 2292,
-     2293, 2293, 2295, 2294, 2296, 2299, 2288, 2297, 2297, 2296,
-     2298, 2298, 2300, 2301, 2302, 2303, 2303, 2299, 2304, 2308,
-     2295, 2305, 2305, 2307, 2300, 2306, 2306, 2310, 2309, 2311,
-     2302, 2308, 2313, 2301, 2307, 2309, 2312, 2304, 2314, 2310,
-     2317, 2312, 2315, 2315, 2316, 2318, 2319, 2320, 2321, 2311,
-     2322, 2322, 2313, 2316, 2323, 2324, 2327, 2325, 2314, 2319,
-     2328, 2329, 2321, 2323, 2330, 2318, 2317, 2330, 2332, 2331,
-     2324, 2320, 2325, 2332, 2327, 2333, 2334, 2334, 2335, 2335,
-     2333, 2341, 2328, 2331, 2329, 2336, 2336, 2338, 2338, 2340,
+     2276, 2273, 2271, 2274, 2278, 2277, 2278, 2281, 2282, 2282,
+     2283, 2285, 2285, 2283, 2287, 2288, 2289, 2291, 2287, 2290,
+     2290, 2288, 2294, 2294, 2284, 2296, 2291, 2298, 2289, 2299,
+     2302, 2303, 2304, 2305, 2312, 2302, 2310, 2304, 2305, 2306,
+     2306, 2298, 2310, 2296, 2313, 2299, 2308, 2308, 2311, 2311,
+     2312, 2314, 2316, 2317, 2318, 2318, 2314, 2303, 2320, 2322,
+     2323, 2327, 2321, 2325, 2325, 2317, 2313, 2320, 2321, 2326,
+     2328, 2316, 2326, 2330, 2330, 2323, 2332, 2322, 2331, 2331,
+     2327, 2332, 2333, 2334, 2335, 2336, 2339, 2336, 2328, 2335,
+     2337, 2338, 2334, 2341, 2340,    0, 2342, 2348, 2339, 2340,
 
-     2340, 2342, 2343, 2345, 2346, 2347, 2348, 2349, 2350, 2341,
-     2352, 2351, 2342, 2351, 2353, 2354, 2349, 2355, 2355, 2357,
-     2357, 2343, 2346, 2345, 2358, 2359, 2348, 2347, 2350, 2362,
-     2352, 2364, 2353, 2354, 2359, 2360, 2360, 2365, 2362, 2363,
-     2363, 2366, 2367, 2368, 2369, 2371, 2358, 2370, 2366, 2364,
-     2372, 2372, 2373, 2373, 2374, 2365, 2379, 2367, 2378, 2375,
-     2380, 2368, 2369, 2370, 2371, 2375, 2376, 2376, 2377, 2382,
-     2381, 2379, 2374, 2383, 2377, 2381, 2378, 2384, 2385, 2380,
-     2385, 2390, 2384, 2386, 2386, 2387, 2392, 2387, 2393, 2382,
-     2388, 2388, 2394, 2383, 2395, 2392, 2396, 2397, 2404, 2398,
+     2333, 2342, 2343, 2343, 2337, 2338, 2344, 2344, 2345, 2345,
+     2346, 2346, 2347, 2341, 2349, 2348, 2350, 2350, 2352, 2349,
+     2351, 2351, 2353, 2354, 2347, 2355, 2356, 2356, 2357, 2360,
+     2352, 2358, 2358, 2361, 2353, 2359, 2359, 2362, 2363, 2364,
+     2360, 2355, 2366, 2354, 2362, 2361, 2365, 2357, 2367, 2369,
+     2363, 2365, 2368, 2368, 2370, 2371, 2372, 2373, 2369, 2364,
+     2374, 2375, 2366, 2376, 2376, 2381, 2382, 2377, 2367, 2372,
+     2378, 2379, 2383, 2375, 2374, 2371, 2377, 2385,    0, 2384,
+     2370, 2373, 2384, 2381, 2386, 2378, 2379, 2387, 2382, 2386,
+     2395, 2385, 2387, 2388, 2388, 2383, 2389, 2389, 2390, 2390,
 
-     2390, 2396, 2401, 2402, 2394, 2405, 2402, 2393, 2403, 2403,
-     2406, 2406, 2407, 2404, 2395, 2409, 2407, 2397, 2398, 2412,
-     2410, 2414, 2401, 2405, 2410, 2411, 2411, 2415, 2416, 2419,
-     2409, 2420, 2412, 2417, 2417, 2421, 2414, 2422, 2422, 2421,
-     2420, 2419, 2423, 2424, 2424, 2425, 2426, 2415, 2416, 2427,
-     2425, 2428, 2429, 2429, 2435, 2426, 2434, 2434, 2436, 2436,
-     2437, 2423, 2438, 2428, 2442, 2427, 2441, 2441, 2439, 2440,
-     2444, 2444,    0, 2437, 2449, 2438, 2435, 2439, 2440, 2442,
-     2447, 2448, 2450, 2451, 2452, 2447, 2448, 2450, 2449, 2453,
-     2456, 2451, 2454, 2459, 2457, 2462, 2458, 2464, 2453, 2457,
+     2392, 2392, 2394, 2394, 2396, 2397, 2398, 2400, 2395, 2402,
+     2401, 2404, 2403, 2405, 2406, 2396, 2406, 2407, 2408, 2414,
+     2404, 2398, 2409,    0, 2397, 2410, 2410, 2400, 2401, 2412,
+     2412, 2402, 2403, 2405, 2415, 2418, 2408, 2407, 2416, 2416,
+     2409, 2414, 2420, 2415, 2418, 2419, 2419, 2421, 2422, 2423,
+     2424, 2425, 2427,    0, 2426, 2422, 2428, 2428, 2429, 2429,
+     2420, 2430, 2432, 2432, 2423, 2421, 2431, 2435, 2424, 2425,
+     2426, 2427, 2431, 2433, 2433, 2434, 2436, 2437, 2438, 2430,
+     2439, 2434, 2440, 2438, 2441, 2435, 2442, 2447, 2442, 2441,
+     2450, 2436, 2443, 2443, 2449, 2444, 2437, 2444, 2445, 2445,
 
-     2454, 2458, 2462, 2452, 2465, 2456, 2460, 2460, 2459, 2461,
-     2461, 2463, 2466, 2469, 2467, 2464, 2463,    0, 2466, 2467,
-     2468, 2468, 2465, 2475, 2470, 2471, 2471,    0, 2469, 2470,
-     2472, 2472, 2476, 2476, 2477, 2478, 2475, 2477, 2479, 2480,
-     2478, 2478, 2481, 2479, 2480, 2482, 2483, 2484, 2481, 2482,
-     2485, 2483, 2486, 2487, 2490, 2488, 2484, 2489, 2491, 2490,
-     2486, 2488, 2493, 2489, 2496, 2485, 2494, 2493, 2498, 2494,
-     2491, 2500, 2499, 2498, 2487, 2501, 2496, 2499, 2502, 2504,
-     2504, 2503, 2505, 2511, 2512, 2517, 2508, 2502, 2501, 2500,
-     2503, 2505, 2508, 2509, 2513, 2514, 2514, 2515, 2516, 2509,
+     2439, 2451, 2440, 2449, 2452, 2453, 2447, 2454, 2458, 2450,
+     2453, 2455, 2459, 2451, 2461, 2459, 2460, 2460, 2462, 2463,
+     2463, 2464, 2466, 2471, 2452, 2464, 2469, 2454, 2458, 2461,
+     2455, 2467, 2468, 2468, 2472, 2467, 2462, 2466, 2471, 2469,
+     2473, 2474, 2474, 2476, 2477, 2478, 2479, 2479, 2480, 2478,
+     2481, 2481, 2482, 2477, 2472, 2476, 2483, 2482, 2484, 2485,
+     2473, 2486, 2486, 2491, 2491, 2483, 2492, 2480, 2493, 2493,
+     2494, 2485, 2495, 2496, 2484, 2497, 2498, 2498, 2499, 2501,
+     2501, 2504, 2496, 2494, 2497, 2495, 2504, 2505, 2492, 2506,
+     2507, 2508, 2505, 2499, 2509, 2507, 2510, 2513, 2511, 2508,
 
-     2517, 2519, 2511, 2521, 2512, 2518, 2518, 2516, 2523, 2526,
-     2524, 2525, 2525, 2513, 2524, 2527, 2515, 2528, 2521, 2529,
-     2519, 2527, 2531, 2528, 2532, 2529, 2530, 2530, 2523, 2532,
-     2531, 2534, 2535, 2537, 2526, 2538, 2539, 2537, 2541, 2541,
-     2534, 2542, 2543, 2543, 2547, 2535, 2544, 2544, 2547, 2538,
-     2548, 2539, 2546, 2546, 2552, 2548, 2550, 2550, 2553, 2542,
-     2554, 2555, 2557, 2553, 2558, 2558, 2555, 2555, 2560, 2560,
-     2561, 2561, 2554, 2562, 2552, 2563, 2562, 2565, 2567, 2568,
-     2568, 2571, 2557, 2569, 2569, 2570, 2570, 2573, 2563, 2572,
-     2572, 2574, 2575, 2576, 2582, 2565, 2571, 2587, 2567, 2576,
+     2516, 2520, 2514, 2506, 2515, 2510, 2511, 2514, 2520, 2515,
+     2517, 2517, 2513, 2509, 2522, 2516, 2518, 2518, 2519, 2519,
+     2521, 2523, 2524, 2527, 2525, 2521, 2526, 2526, 2524, 2525,
+     2528, 2533, 2522, 2529, 2529, 2528, 2530, 2530, 2527, 2523,
+     2534, 2534, 2535, 2536, 2533, 2535, 2537, 2538, 2536, 2536,
+     2539, 2537, 2538, 2540, 2541, 2542, 2543, 2544, 2541, 2540,
+     2542, 2545, 2546, 2550, 2539, 2543, 2549, 2547, 2548, 2545,
+     2555, 2549, 2544, 2547, 2548, 2550, 2552, 2553, 2559, 2557,
+     2553, 2552, 2555, 2546, 2557, 2558, 2560, 2571, 2561, 2562,
+     2558, 2563, 2563, 2564, 2567, 2568, 2559, 2561, 2562, 2560,
 
-     2573, 2577, 2577, 2578, 2583, 2581, 2575, 2578, 2584, 2574,
-     2581, 2581, 2585, 2586, 2589, 2589, 2588, 2582, 2585, 2586,
-     2588, 2592, 2587, 2594, 2583, 2597, 2592, 2595, 2584, 2598,
-     2595, 2594, 2598, 2600, 2599, 2601, 2602,    0, 2600, 2608,
-     2603, 2604, 2604, 2605, 2606, 2607, 2611, 2606, 2612, 2612,
-     2597, 2599, 2599, 2601, 2603, 2606, 2602, 2605, 2608, 2607,
-     2609, 2610, 2613, 2613, 2617, 2611, 2610, 2610, 2609, 2614,
-     2614, 2615, 2615, 2616, 2616, 2619, 2618, 2620, 2621, 2622,
-     2617, 2618, 2623, 2629, 2622, 2624, 2625, 2627, 2627, 2628,
-     2662, 2623, 2628, 2631, 2631, 2619, 2641, 2621, 2633, 2633,
+     2567, 2568, 2564, 2572, 2576, 2573, 2571, 2574, 2574, 2575,
+     2577, 2578, 2578, 2576, 2579, 2581, 2583, 2584, 2585, 2585,
+     2586, 2584, 2592, 2572, 2573, 2577, 2587, 2592, 2575, 2588,
+     2581, 2589, 2587, 2579, 2591, 2588, 2583, 2589, 2590, 2590,
+     2594, 2595, 2591, 2597, 2598, 2586, 2599, 2597, 2602, 2594,
+     2601, 2601, 2603, 2603, 2595, 2604, 2604, 2608, 2598, 2606,
+     2606, 2599, 2608, 2607, 2610, 2610, 2602, 2607, 2612, 2613,
+     2614, 2615, 2617, 2625, 2613, 2627, 2615, 2615, 2618, 2618,
+     2620, 2620, 2614, 2621, 2621, 2623, 2622, 2631, 2612, 2622,
+     2634, 2625, 2617, 2628, 2628, 2627, 2629, 2629, 2623, 2630,
 
-     2632, 2629, 2662, 2620, 2634, 2624, 2625, 2632, 2637, 2634,
-     2636, 2636, 2638, 2639, 2641, 2642, 2642, 2637, 2644, 2643,
-     2645, 2638, 2639, 2643, 2646, 2647, 2653, 2644, 2648, 2646,
-     2646, 2653, 2649, 2654, 2654, 2645, 2649, 2648, 2647, 2656,
-     2656, 2657, 2658, 2659, 2661, 2665, 2667, 2666, 2668, 2687,
-     2670, 2672, 2674, 2661, 2668, 2657, 2666, 2674, 2675, 2676,
-     2676, 2659, 2670, 2675, 2677, 2686, 2667, 2658, 2687, 2679,
-     2665, 2694, 2672, 2677, 2679, 2680, 2680, 2682, 2682, 2680,
-     2683, 2683, 2684, 2684, 2685, 2686, 2688, 2691, 2690, 2694,
-     2692, 2688, 2691, 2685, 2690, 2692, 2693, 2693, 2695, 2696,
+     2630, 2633, 2631, 2632, 2632, 2635, 2636, 2638, 2634, 2637,
+     2637, 2638, 2636, 2643, 2633, 2642, 2646, 2644, 2645, 2635,
+     2642, 2642, 2646, 2647, 2648, 2655, 2649, 2650, 2650, 2647,
+     2649, 2658, 2656, 2655, 2653, 2656, 2643, 2644, 2645, 2653,
+     2659, 2660, 2660, 2659, 2661, 2662, 2663, 2664, 2707, 2648,
+     2662, 2665, 2666, 2666, 2667, 2668, 2658, 2669, 2668, 2670,
+     2673, 2661, 2661, 2707, 2663, 2665, 2668, 2664, 2667, 2671,
+     2672, 2669, 2674, 2674, 2679, 2672, 2672, 2671, 2670, 2673,
+     2675, 2675, 2676, 2676, 2677, 2677, 2678, 2678, 2680, 2681,
+     2679, 2682, 2683, 2680, 2684, 2685, 2686, 2691, 2687, 2684,
 
-     2697, 2698, 2699, 2706, 2696, 2700, 2700, 2698, 2702, 2703,
-     2704, 2707, 2702, 2708, 2703, 2704, 2705, 2705, 2697, 2695,
-     2710, 2710, 2706, 2712, 2713, 2714, 2707, 2699, 2716, 2714,
-     2715, 2717, 2718, 2708, 2721, 2722, 2712, 2713, 2719, 2715,
-     2718, 2724, 2720, 2719, 2716, 2723, 2723, 2726, 2726, 2729,
-     2717, 2720, 2721, 2727, 2727, 2731, 2731, 2733, 2734, 2735,
-     2724, 2722, 2736, 2738, 2738, 2739, 2740, 2736, 2741, 2744,
-     2729, 2743, 2743, 2733, 2734, 2735, 2745, 2746, 2746, 2749,
-     2750, 2752, 2755, 2744, 2759, 2739, 2750, 2741, 2751, 2740,
-     2753, 2753, 2761, 2751, 2757, 2745, 2754, 2754, 2758, 2749,
+     2689, 2689, 2690, 2694, 2685, 2690, 2693, 2693, 2703, 2681,
+     2694, 2683, 2695, 2695, 2696, 2691, 2686, 2682, 2687, 2696,
+     2698, 2698, 2699, 2700, 2701, 2705, 2703, 2704, 2704, 2705,
+     2706, 2699, 2700, 2701, 2709, 2708, 2710, 2720, 2711, 2706,
+     2708, 2708, 2711, 2715, 2719, 2710, 2721, 2709, 2715, 2716,
+     2716, 2718, 2718, 2724, 2723, 2727, 2729, 2728, 2719, 2732,
+     2734, 2730, 2720, 2723, 2721, 2724, 2728, 2730, 2736, 2737,
+     2739, 2732, 2828, 2736, 2737, 2828, 2729, 2738, 2738, 2739,
+     2727, 2734, 2741, 2748, 2742, 2742, 2747, 2741, 2742, 2744,
+     2744, 2745, 2745, 2746, 2746, 2747, 2749, 2750, 2752, 2756,
 
-     2756, 2756, 2755, 2752, 2759, 2757, 2760, 2758, 2763, 2762,
-     2770, 2761, 2760, 2764, 2764, 2765, 2766, 2766, 2765, 2771,
-     2756, 2762, 2770, 2772, 2773, 2773, 2775, 2774, 2763, 2772,
-     2774, 2776, 2775, 2778, 2780, 2779, 2781, 2782, 2778, 2771,
-     2779, 2786, 2781, 2783, 2783, 2785, 2787, 2788, 2790, 2776,
-     2789, 2789, 2791, 2780, 2782, 2782, 2796, 2785, 2801, 2786,
-     2788, 2791, 2793, 2793, 2794, 2794, 2802, 2790, 2795, 2797,
-     2796, 2787, 2802, 2795, 2797, 2798, 2798, 2799, 2799, 2800,
-     2800, 2803, 2805, 2805, 2801, 2808, 2803, 2810, 2811, 2812,
-     2813, 2813, 2815, 2815, 2816, 2817, 2818, 2819, 2819, 2820,
+     2753, 2754, 2750, 2748, 2752, 2753, 2754, 2755, 2755, 2757,
+     2758, 2759, 2760, 2761, 2762, 2749, 2759, 2756, 2769, 2761,
+     2765, 2757, 2763, 2763, 2765, 2768, 2768, 2766, 2767, 2770,
+     2760, 2758, 2766, 2767, 2771, 2773, 2773, 2769, 2775, 2762,
+     2776, 2777, 2779, 2778, 2770, 2777, 2780, 2781, 2783, 2784,
+     2785, 2775, 2778, 2776, 2771, 2781, 2782, 2783, 2779, 2786,
+     2786, 2782, 2787, 2789, 2789, 2780, 2792, 2784, 2790, 2790,
+     2794, 2794, 2796, 2797, 2798, 2799, 2785, 2801, 2801, 2802,
+     2799, 2787, 2803, 2804, 2806, 2806, 2807, 2792, 2796, 2797,
+     2798, 2808, 2809, 2809, 2812, 2813, 2815, 2818, 2814, 2802,
 
-     2820, 2822, 2823,    0, 2808, 2818, 2824, 2822, 2816, 2810,
-     2811, 2812, 2825, 2828, 2828, 2817, 2831, 2825, 2830, 2830,
-     2832, 2831, 2823, 2833, 2834, 2824, 2839, 2835, 2837, 2833,
-     2836, 2836, 2840, 2837, 2832, 2835, 2834, 2841, 2842, 2843,
-     2845, 2846, 2841, 2847, 2848, 2843, 2839, 2849, 2845, 2856,
-     2842, 2850, 2840, 2851, 2852, 2866, 2853, 2855, 2860, 2866,
-     2846, 2853, 2855, 2847, 2848, 2849, 2857, 2850, 2858, 2856,
-     2851, 2851, 2857, 2858, 2861, 2852, 2864, 2864, 2860, 2865,
-     2865, 2870, 2871, 2872, 2872,    0, 2870, 2861, 2874, 2874,
-     2875, 2875, 2878, 2875, 2876, 2876, 2878, 2876, 2881, 2877,
+     2807, 2813, 2804, 2814, 2820, 2803, 2816, 2816, 2817, 2817,
+     2808, 2819, 2819, 2821, 2812, 2820, 2822, 2818, 2815, 2823,
+     2824, 2825, 2821, 2826, 2834, 2823, 2827, 2827, 2829, 2829,
+     2833, 2819, 2835, 2825, 2836, 2836, 2822, 2837, 2835, 2824,
+     2837, 2838, 2833, 2826, 2834, 2839, 2841, 2838, 2842, 2842,
+     2843, 2841, 2844, 2845, 2849, 2843, 2846, 2847, 2847, 2845,
+     2850, 2851, 2852, 2839, 2853, 2853, 2849, 2855, 2854, 2857,
+     2857, 2844, 2859, 2846, 2846, 2852, 2855, 2859, 2850, 2858,
+     2858, 2860, 2865, 2861, 2862, 2862, 2851, 2854, 2861, 2863,
+     2863, 2864, 2864, 2866, 2872, 2860, 2867, 2869, 2869, 2866,
 
-     2877, 2871, 2877, 2880, 2880, 2882, 2885, 2886, 2887, 2888,
-     2888, 2891, 2897, 2887, 2892, 2894, 2881, 2895, 2893, 2882,
-     2898, 2892, 2893, 2907, 2894, 2906, 2885, 2886, 2902, 2898,
-     2897, 2906, 2895, 2899, 2899, 2904, 2891, 2900, 2900, 2901,
-     2901, 2903, 2908, 2902, 2904, 2905, 2903, 2904, 2907, 2909,
-     2905, 2905, 2912, 2910, 2911, 2913, 2913, 2908, 2910, 2911,
-     2914, 2915, 2916, 2916, 2917, 2917, 2914, 2915, 2918, 2923,
-     2909, 2912,    0, 2918, 2921, 2921, 2922, 2922, 2923, 2926,
-     2926, 2927, 2927, 2928, 2928, 2929, 2929, 2930, 2930, 2931,
-     2931, 2932, 2932, 2934, 2935, 2935, 2936, 2937, 2938, 2942,
+     2874, 2867, 2875, 2876, 2877, 2877, 2879, 2879, 2865, 2880,
+     2881, 2882, 2886, 2872, 2883, 2883, 2884, 2884, 2886, 2887,
+     2882, 2888, 2874, 2880, 2875, 2876, 2889, 2892, 2892, 2895,
+     2881, 2889, 2894, 2894, 2895, 2896, 2897, 2899, 2898, 2887,
+     2888, 2901, 2897, 2900, 2900, 2899, 2901, 2903, 2904, 2896,
+     2898, 2905, 2906, 2907, 2909, 2910, 2905, 2911, 2912, 2907,
+     2915, 2914, 2909, 2916, 2906, 2917, 2918, 2903, 2904, 2921,
+     2920, 2918, 2925, 3017, 2910, 2920, 2915, 2911, 2912, 2914,
+     2916, 2916, 2922, 2926, 2936, 2923, 2917, 2931, 2922, 2921,
+     2923, 2931, 2925, 2929, 2929, 2935, 2926, 2930, 2930, 3017,
 
-     2940, 2944, 2934, 2941, 2941, 2936, 2946, 2943, 2950, 2937,
-     2945, 2945, 2952, 2944, 2942, 2947, 2947, 2954, 2938, 2940,
-     2943, 2946, 2951, 2953, 2953, 2951, 2950, 2956, 2957, 2958,
-     2956, 2959, 2960, 2962, 2957, 2954, 2959, 2961, 2952, 2964,
-     2971, 2965, 2968, 2958, 2979, 2964, 2981, 2979, 2986, 2962,
-     2965, 2960, 2982, 2982, 2988, 2961, 2987, 2968, 2988, 2981,
-     2983, 2983, 2984, 2984, 2989, 2987, 2971, 2990, 2992, 2993,
-     2994, 2986, 2995, 2996, 2995, 2994, 2997, 2997, 2999, 2998,
-     2993, 2990, 3000, 3001, 2989, 3002, 3003, 3004, 2996, 3007,
-     3005, 2992, 2998, 3006, 3007, 3008, 3004, 2999, 3009, 3001,
+     2935, 2937, 2937, 2936, 2939, 2939, 2940, 2940, 2943, 2940,
+     2941, 2941, 2943, 2941, 2942, 2942, 2946, 2942, 2945, 2945,
+     2950, 2947, 2951, 2952, 2953, 2953, 2956, 2958, 2952, 2957,
+     2959, 2958, 2960,    0, 2946, 2947, 2957, 2962, 2967, 2959,
+     2950, 2963, 2951, 2964, 2964, 2965, 2965, 2960, 2966, 2966,
+     2963, 2956, 2968, 2967, 2969, 2962, 2970, 2968, 2971, 2972,
+     2973, 2970, 2970, 2969, 2971, 2974, 2969, 2975, 2976, 2977,
+     2978, 2978, 2975, 2976, 2979, 2973, 2980, 2981, 2981, 3003,
+     2979, 3053, 2980,    0, 2972, 3053, 2974, 2983, 2977, 2982,
+     2982, 2988, 2983, 2986, 2986, 2987, 2987, 2991, 2991, 3003,
 
-     3000, 3003, 3005, 3009, 3013, 3014, 3015, 3015, 3016, 3021,
-     3002, 3017, 3017, 3022, 3006, 3008, 3026, 3016, 3013, 3018,
-     3018, 3019, 3019, 3020, 3020, 3014, 3023, 3024, 3021, 3023,
-     3025, 3027, 3024, 3022, 3028, 3025, 3029, 3030, 3031, 3032,
-     3028, 3026, 3035, 3031, 3033, 3033, 3027, 3034, 3034, 3030,
-     3029, 3036, 3037, 3037, 3039, 3041, 3046, 3035, 3047, 3032,
-     3044, 3044, 3045, 3045, 3046, 3048, 3049, 3050, 3058, 3039,
-     3036, 3048, 3049, 3041, 3051, 3052, 3059, 3047, 3053, 3054,
-     3054, 3050, 3064, 3053, 3055, 3055, 3061, 3051, 3062, 3058,
-     3065, 3066, 3062, 3067, 3052, 3065, 3059, 3069, 3068, 3070,
+     2988, 2992, 2992, 2993, 2993, 2994, 2994, 2995, 2995, 2996,
+     2996, 2997, 2997, 2999, 3000, 3000, 3001, 3002, 3005, 3006,
+     3006, 3007, 2999, 3009, 3015, 3001, 3008, 3010, 3010, 3002,
+     3011, 3012, 3012, 3018, 3018, 3009, 3007, 3005, 3016, 3008,
+     3019, 3016, 3015, 3021, 3022, 3011, 3021, 3023, 3024, 3025,
+     3022, 3026, 3033, 3024, 3027, 3030, 3029, 3036, 3019, 3046,
+     3044, 3023, 3029, 3044, 3030, 3047, 3047, 3033, 3025, 3026,
+     3027, 3051, 3046, 3048, 3048, 3049, 3049, 3052, 3054, 3055,
+     3057, 3058, 3059, 3036, 3061, 3064, 3052, 3059, 3060, 3063,
+     3060, 3065, 3058, 3055, 3051, 3062, 3062, 3066, 3054, 3061,
 
-     3061, 3075, 3064, 3071, 3070, 3076, 3067, 3077, 3071,    0,
-     3066, 3068, 3072, 3072, 3078, 3078, 3069, 3079, 3080, 3081,
-     3081, 3075, 3079, 3076, 3080, 3082, 3077, 3083, 3084, 3085,
-     3082, 3086, 3083, 3084, 3088, 3088, 3089, 3086, 3090, 3090,
-     3092, 3089, 3093, 3094, 3092, 3095, 3096, 3097, 3085, 3098,
-     3094, 3101, 3101, 3097, 3099, 3103, 3103, 3104, 3105, 3106,
-     3107, 3093, 3108, 3105, 3095, 3096, 3104, 3099, 3098, 3104,
-     3109, 3109, 3110, 3111, 3113, 3108, 3115, 3110, 3106, 3107,
-     3114, 3114, 3116, 3116, 3117, 3117, 3111, 3118, 3120, 3119,
-     3121, 3121, 3118, 3122, 3127, 3115, 3119, 3123, 3122, 3123,
+     3067, 3068, 3063, 3057, 3064, 3069, 3070, 3071, 3078, 3065,
+     3072, 3073, 3074, 3066, 3069, 3072, 3068, 3074, 3070, 3079,
+     3080, 3080, 3078, 3081, 3086, 3067, 3082, 3082, 3071, 3083,
+     3083, 3073, 3081, 3084, 3084, 3085, 3085, 3087, 3088, 3079,
+     3089, 3088, 3090, 3086, 3091, 3089, 3092, 3090, 3093, 3094,
+     3095, 3096, 3097, 3100, 3093, 3101, 3096, 3087, 3098, 3098,
+     3104, 3092, 3095, 3094, 3099, 3099, 3102, 3102, 3100, 3091,
+     3106, 3112, 3097, 3111, 3101, 3104, 3109, 3109, 3110, 3110,
+     3113, 3111, 3115, 3114, 3116, 3117, 3113, 3118, 3106, 3114,
+     3112, 3123, 3118, 3119, 3119, 3124, 3115, 3116, 3120, 3120,
 
-     3113, 3124, 3124, 3125, 3126, 3129, 3132, 3120, 3136, 3128,
-     3125, 3126, 3134, 3127, 3128, 3131, 3131, 3134, 3135, 3137,
-     3138, 3138, 3141, 3135, 3129, 3132, 3142, 3136, 3140, 3140,
-     3143, 3143, 3144, 3144, 3155, 3145, 3147, 3147, 3137, 3148,
-     3148, 3141, 3145, 3149, 3151, 3142, 3154, 3156,    0, 3151,
-     3149, 3154,    0, 3155, 3157, 3157, 3158, 3158,    0,    0,
-        0,    0,    0,    0,    0,    0, 3156, 3162, 3162, 3162,
-     3162, 3162, 3162, 3162, 3163, 3163, 3163, 3163, 3163, 3163,
-     3163, 3164, 3164, 3164, 3164, 3164, 3164, 3164, 3165, 3165,
-     3165, 3165, 3165, 3165, 3165, 3166, 3166, 3166, 3166, 3166,
+     3126, 3127, 3129, 3130, 3117, 3127, 3131, 3132, 3130, 3134,
+     3133, 3135, 3123, 3136, 3126, 3124, 3135, 3140, 3136, 3142,
+     3132, 3141, 3129, 3133,    0, 3131, 3137, 3137, 3134, 3143,
+     3143, 3144, 3146, 3146, 3145, 3150, 3144, 3140, 3142, 3141,
+     3145, 3147, 3148, 3149, 3151, 3157, 3147, 3148, 3149, 3157,
+     3151, 3153, 3153, 3154, 3150, 3155, 3155, 3158, 3154, 3159,
+     3160, 3161, 3162, 3163, 3164, 3171, 3159, 3178, 3162, 3166,
+     3166, 3168, 3168, 3170, 3169, 3172, 3158, 3164, 3170, 3160,
+     3161, 3180, 3163, 3169, 3171, 3173, 3169, 3174, 3174, 3176,
+     3175, 3179, 3179, 3178, 3172, 3175, 3181, 3181, 3173, 3185,
 
-     3166, 3166, 3168, 3168,    0, 3168, 3168, 3168, 3168, 3169,
-     3169,    0,    0,    0, 3169, 3169, 3170, 3170,    0,    0,
-     3170,    0, 3170, 3171,    0,    0,    0,    0,    0, 3171,
-     3172, 3172,    0,    0,    0, 3172, 3172, 3173,    0,    0,
-        0,    0,    0, 3173, 3174, 3174,    0, 3174, 3174, 3174,
-     3174, 3175, 3175,    0, 3175, 3175, 3175, 3175, 3161, 3161,
-     3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161,
-     3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161,
-     3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161,
-     3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161, 3161
+     3180, 3183, 3176, 3182, 3182, 3184, 3183, 3186, 3186, 3187,
+     3190, 3188, 3184, 3188, 3187, 3189, 3189, 3190, 3185, 3191,
+     3192, 3194, 3193, 3196, 3196, 3197, 3191, 3193, 3199, 3200,
+     3201, 3202, 3206, 3199, 3200, 3203, 3203, 3205, 3205, 3192,
+     3194, 3207, 3208, 3208, 3197, 3209, 3209, 3210, 3220, 3201,
+     3202, 3206, 3212, 3212, 3210, 3213, 3213, 3214, 3216, 3221,
+     3207, 3219,    0, 3216, 3214,    0, 3219, 3220, 3222, 3222,
+     3223, 3223,    0,    0,    0,    0,    0,    0, 3221, 3227,
+     3227, 3227, 3227, 3227, 3227, 3227, 3228, 3228, 3228, 3228,
+     3228, 3228, 3228, 3229, 3229, 3229, 3229, 3229, 3229, 3229,
 
+     3230, 3230, 3230, 3230, 3230, 3230, 3230, 3231, 3231, 3231,
+     3231, 3231, 3231, 3231, 3232, 3232, 3232, 3232, 3232, 3232,
+     3232, 3233, 3233, 3233, 3233, 3233, 3233, 3233, 3235, 3235,
+        0, 3235, 3235, 3235, 3235, 3236, 3236,    0,    0,    0,
+     3236, 3236, 3237, 3237,    0,    0, 3237,    0, 3237, 3238,
+        0,    0,    0,    0,    0, 3238, 3239, 3239,    0,    0,
+        0, 3239, 3239, 3240,    0,    0,    0,    0,    0, 3240,
+     3241, 3241,    0, 3241, 3241, 3241, 3241, 3242,    0,    0,
+        0,    0,    0, 3242, 3243, 3243,    0,    0,    0, 3243,
+     3243, 3244, 3244,    0, 3244, 3244, 3244, 3244, 3226, 3226,
+
+     3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226,
+     3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226,
+     3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226,
+     3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226, 3226
     } ;
 
 static yy_state_type yy_last_accepting_state;
@@ -2897,11 +2950,13 @@ struct inc_state {
 	int line;
 	YY_BUFFER_STATE buffer;
 	struct inc_state* next;
+	int inc_toplevel;
 };
 static struct inc_state* config_include_stack = NULL;
 static int inc_depth = 0;
 static int inc_prev = 0;
 static int num_args = 0;
+static int inc_toplevel = 0;
 
 void init_cfg_parse(void)
 {
@@ -2909,14 +2964,15 @@ void init_cfg_parse(void)
 	inc_depth = 0;
 	inc_prev = 0;
 	num_args = 0;
+	inc_toplevel = 0;
 }
 
-static void config_start_include(const char* filename)
+static void config_start_include(const char* filename, int toplevel)
 {
 	FILE *input;
 	struct inc_state* s;
 	char* nm;
-	if(inc_depth++ > 100000) {
+	if(inc_depth+1 > 100000) {
 		ub_c_error_msg("too many include files");
 		return;
 	}
@@ -2948,17 +3004,20 @@ static void config_start_include(const char* filename)
 		return;
 	}
 	LEXOUT(("switch_to_include_file(%s)\n", filename));
+	inc_depth++;
 	s->filename = cfg_parser->filename;
 	s->line = cfg_parser->line;
 	s->buffer = YY_CURRENT_BUFFER;
+	s->inc_toplevel = inc_toplevel;
 	s->next = config_include_stack;
 	config_include_stack = s;
 	cfg_parser->filename = nm;
 	cfg_parser->line = 1;
+	inc_toplevel = toplevel;
 	yy_switch_to_buffer(yy_create_buffer(input, YY_BUF_SIZE));
 }
 
-static void config_start_include_glob(const char* filename)
+static void config_start_include_glob(const char* filename, int toplevel)
 {
 
 	/* check for wildcards */
@@ -2991,19 +3050,19 @@ static void config_start_include_glob(const char* filename)
 			globfree(&g);
 			if(r == GLOB_NOMATCH)
 				return; /* no matches for pattern */
-			config_start_include(filename); /* let original deal with it */
+			config_start_include(filename, toplevel); /* let original deal with it */
 			return;
 		}
 		/* process files found, if any */
 		for(i=(int)g.gl_pathc-1; i>=0; i--) {
-			config_start_include(g.gl_pathv[i]);
+			config_start_include(g.gl_pathv[i], toplevel);
 		}
 		globfree(&g);
 		return;
 	}
 #endif /* HAVE_GLOB */
 
-	config_start_include(filename);
+	config_start_include(filename, toplevel);
 }
 
 static void config_end_include(void)
@@ -3017,6 +3076,7 @@ static void config_end_include(void)
 	yy_delete_buffer(YY_CURRENT_BUFFER);
 	yy_switch_to_buffer(s->buffer);
 	config_include_stack = s->next;
+	inc_toplevel = s->inc_toplevel;
 	free(s);
 }
 
@@ -3029,18 +3089,18 @@ static void config_end_include(void)
         }
 #endif
 
-#line 3031 "<stdout>"
+#line 3091 "<stdout>"
 #define YY_NO_INPUT 1
-#line 184 "./util/configlexer.lex"
+#line 191 "./util/configlexer.lex"
 #ifndef YY_NO_UNPUT
 #define YY_NO_UNPUT 1
 #endif
 #ifndef YY_NO_INPUT
 #define YY_NO_INPUT 1
 #endif
-#line 3040 "<stdout>"
+#line 3100 "<stdout>"
 
-#line 3042 "<stdout>"
+#line 3102 "<stdout>"
 
 #define INITIAL 0
 #define quotedstring 1
@@ -3048,6 +3108,8 @@ static void config_end_include(void)
 #define include 3
 #define include_quoted 4
 #define val 5
+#define include_toplevel 6
+#define include_toplevel_quoted 7
 
 #ifndef YY_NO_UNISTD_H
 /* Special case for "unistd.h", since it is non-ANSI. We include it way
@@ -3260,9 +3322,9 @@ YY_DECL
 		}
 
 	{
-#line 204 "./util/configlexer.lex"
+#line 211 "./util/configlexer.lex"
 
-#line 3264 "<stdout>"
+#line 3326 "<stdout>"
 
 	while ( /*CONSTCOND*/1 )		/* loops until end-of-file is reached */
 		{
@@ -3295,13 +3357,13 @@ yy_match:
 			while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 				{
 				yy_current_state = (int) yy_def[yy_current_state];
-				if ( yy_current_state >= 3162 )
+				if ( yy_current_state >= 3227 )
 					yy_c = yy_meta[yy_c];
 				}
 			yy_current_state = yy_nxt[yy_base[yy_current_state] + yy_c];
 			++yy_cp;
 			}
-		while ( yy_base[yy_current_state] != 6159 );
+		while ( yy_base[yy_current_state] != 6299 );
 
 yy_find_action:
 		yy_act = yy_accept[yy_current_state];
@@ -3327,1548 +3389,1558 @@ do_action:	/* This label is used only to access EOF actions. */
 
 case 1:
 YY_RULE_SETUP
-#line 205 "./util/configlexer.lex"
+#line 212 "./util/configlexer.lex"
 { 
 	LEXOUT(("SP ")); /* ignore */ }
 	YY_BREAK
 case 2:
 YY_RULE_SETUP
-#line 207 "./util/configlexer.lex"
+#line 214 "./util/configlexer.lex"
 { 
 	/* note that flex makes the longest match and '.' is any but not nl */
 	LEXOUT(("comment(%s) ", yytext)); /* ignore */ }
 	YY_BREAK
 case 3:
 YY_RULE_SETUP
-#line 210 "./util/configlexer.lex"
+#line 217 "./util/configlexer.lex"
 { YDVAR(0, VAR_SERVER) }
 	YY_BREAK
 case 4:
 YY_RULE_SETUP
-#line 211 "./util/configlexer.lex"
+#line 218 "./util/configlexer.lex"
 { YDVAR(1, VAR_QNAME_MINIMISATION) }
 	YY_BREAK
 case 5:
 YY_RULE_SETUP
-#line 212 "./util/configlexer.lex"
+#line 219 "./util/configlexer.lex"
 { YDVAR(1, VAR_QNAME_MINIMISATION_STRICT) }
 	YY_BREAK
 case 6:
 YY_RULE_SETUP
-#line 213 "./util/configlexer.lex"
+#line 220 "./util/configlexer.lex"
 { YDVAR(1, VAR_NUM_THREADS) }
 	YY_BREAK
 case 7:
 YY_RULE_SETUP
-#line 214 "./util/configlexer.lex"
+#line 221 "./util/configlexer.lex"
 { YDVAR(1, VAR_VERBOSITY) }
 	YY_BREAK
 case 8:
 YY_RULE_SETUP
-#line 215 "./util/configlexer.lex"
+#line 222 "./util/configlexer.lex"
 { YDVAR(1, VAR_PORT) }
 	YY_BREAK
 case 9:
 YY_RULE_SETUP
-#line 216 "./util/configlexer.lex"
+#line 223 "./util/configlexer.lex"
 { YDVAR(1, VAR_OUTGOING_RANGE) }
 	YY_BREAK
 case 10:
 YY_RULE_SETUP
-#line 217 "./util/configlexer.lex"
+#line 224 "./util/configlexer.lex"
 { YDVAR(1, VAR_OUTGOING_PORT_PERMIT) }
 	YY_BREAK
 case 11:
 YY_RULE_SETUP
-#line 218 "./util/configlexer.lex"
+#line 225 "./util/configlexer.lex"
 { YDVAR(1, VAR_OUTGOING_PORT_AVOID) }
 	YY_BREAK
 case 12:
 YY_RULE_SETUP
-#line 219 "./util/configlexer.lex"
+#line 226 "./util/configlexer.lex"
 { YDVAR(1, VAR_OUTGOING_NUM_TCP) }
 	YY_BREAK
 case 13:
 YY_RULE_SETUP
-#line 220 "./util/configlexer.lex"
+#line 227 "./util/configlexer.lex"
 { YDVAR(1, VAR_INCOMING_NUM_TCP) }
 	YY_BREAK
 case 14:
 YY_RULE_SETUP
-#line 221 "./util/configlexer.lex"
+#line 228 "./util/configlexer.lex"
 { YDVAR(1, VAR_DO_IP4) }
 	YY_BREAK
 case 15:
 YY_RULE_SETUP
-#line 222 "./util/configlexer.lex"
+#line 229 "./util/configlexer.lex"
 { YDVAR(1, VAR_DO_IP6) }
 	YY_BREAK
 case 16:
 YY_RULE_SETUP
-#line 223 "./util/configlexer.lex"
+#line 230 "./util/configlexer.lex"
 { YDVAR(1, VAR_PREFER_IP4) }
 	YY_BREAK
 case 17:
 YY_RULE_SETUP
-#line 224 "./util/configlexer.lex"
+#line 231 "./util/configlexer.lex"
 { YDVAR(1, VAR_PREFER_IP6) }
 	YY_BREAK
 case 18:
 YY_RULE_SETUP
-#line 225 "./util/configlexer.lex"
+#line 232 "./util/configlexer.lex"
 { YDVAR(1, VAR_DO_UDP) }
 	YY_BREAK
 case 19:
 YY_RULE_SETUP
-#line 226 "./util/configlexer.lex"
+#line 233 "./util/configlexer.lex"
 { YDVAR(1, VAR_DO_TCP) }
 	YY_BREAK
 case 20:
 YY_RULE_SETUP
-#line 227 "./util/configlexer.lex"
+#line 234 "./util/configlexer.lex"
 { YDVAR(1, VAR_TCP_UPSTREAM) }
 	YY_BREAK
 case 21:
 YY_RULE_SETUP
-#line 228 "./util/configlexer.lex"
+#line 235 "./util/configlexer.lex"
 { YDVAR(1, VAR_TCP_MSS) }
 	YY_BREAK
 case 22:
 YY_RULE_SETUP
-#line 229 "./util/configlexer.lex"
+#line 236 "./util/configlexer.lex"
 { YDVAR(1, VAR_OUTGOING_TCP_MSS) }
 	YY_BREAK
 case 23:
 YY_RULE_SETUP
-#line 230 "./util/configlexer.lex"
+#line 237 "./util/configlexer.lex"
 { YDVAR(1, VAR_TCP_IDLE_TIMEOUT) }
 	YY_BREAK
 case 24:
 YY_RULE_SETUP
-#line 231 "./util/configlexer.lex"
+#line 238 "./util/configlexer.lex"
 { YDVAR(1, VAR_EDNS_TCP_KEEPALIVE) }
 	YY_BREAK
 case 25:
 YY_RULE_SETUP
-#line 232 "./util/configlexer.lex"
+#line 239 "./util/configlexer.lex"
 { YDVAR(1, VAR_EDNS_TCP_KEEPALIVE_TIMEOUT) }
 	YY_BREAK
 case 26:
 YY_RULE_SETUP
-#line 233 "./util/configlexer.lex"
+#line 240 "./util/configlexer.lex"
 { YDVAR(1, VAR_SSL_UPSTREAM) }
 	YY_BREAK
 case 27:
 YY_RULE_SETUP
-#line 234 "./util/configlexer.lex"
+#line 241 "./util/configlexer.lex"
 { YDVAR(1, VAR_SSL_UPSTREAM) }
 	YY_BREAK
 case 28:
 YY_RULE_SETUP
-#line 235 "./util/configlexer.lex"
+#line 242 "./util/configlexer.lex"
 { YDVAR(1, VAR_SSL_SERVICE_KEY) }
 	YY_BREAK
 case 29:
 YY_RULE_SETUP
-#line 236 "./util/configlexer.lex"
+#line 243 "./util/configlexer.lex"
 { YDVAR(1, VAR_SSL_SERVICE_KEY) }
 	YY_BREAK
 case 30:
 YY_RULE_SETUP
-#line 237 "./util/configlexer.lex"
+#line 244 "./util/configlexer.lex"
 { YDVAR(1, VAR_SSL_SERVICE_PEM) }
 	YY_BREAK
 case 31:
 YY_RULE_SETUP
-#line 238 "./util/configlexer.lex"
+#line 245 "./util/configlexer.lex"
 { YDVAR(1, VAR_SSL_SERVICE_PEM) }
 	YY_BREAK
 case 32:
 YY_RULE_SETUP
-#line 239 "./util/configlexer.lex"
+#line 246 "./util/configlexer.lex"
 { YDVAR(1, VAR_SSL_PORT) }
 	YY_BREAK
 case 33:
 YY_RULE_SETUP
-#line 240 "./util/configlexer.lex"
+#line 247 "./util/configlexer.lex"
 { YDVAR(1, VAR_SSL_PORT) }
 	YY_BREAK
 case 34:
 YY_RULE_SETUP
-#line 241 "./util/configlexer.lex"
+#line 248 "./util/configlexer.lex"
 { YDVAR(1, VAR_TLS_CERT_BUNDLE) }
 	YY_BREAK
 case 35:
 YY_RULE_SETUP
-#line 242 "./util/configlexer.lex"
+#line 249 "./util/configlexer.lex"
 { YDVAR(1, VAR_TLS_CERT_BUNDLE) }
 	YY_BREAK
 case 36:
 YY_RULE_SETUP
-#line 243 "./util/configlexer.lex"
+#line 250 "./util/configlexer.lex"
 { YDVAR(1, VAR_TLS_WIN_CERT) }
 	YY_BREAK
 case 37:
 YY_RULE_SETUP
-#line 244 "./util/configlexer.lex"
+#line 251 "./util/configlexer.lex"
 { YDVAR(1, VAR_TLS_ADDITIONAL_PORT) }
 	YY_BREAK
 case 38:
 YY_RULE_SETUP
-#line 245 "./util/configlexer.lex"
+#line 252 "./util/configlexer.lex"
 { YDVAR(1, VAR_TLS_ADDITIONAL_PORT) }
 	YY_BREAK
 case 39:
 YY_RULE_SETUP
-#line 246 "./util/configlexer.lex"
+#line 253 "./util/configlexer.lex"
 { YDVAR(1, VAR_TLS_ADDITIONAL_PORT) }
 	YY_BREAK
 case 40:
 YY_RULE_SETUP
-#line 247 "./util/configlexer.lex"
+#line 254 "./util/configlexer.lex"
 { YDVAR(1, VAR_TLS_ADDITIONAL_PORT) }
 	YY_BREAK
 case 41:
 YY_RULE_SETUP
-#line 248 "./util/configlexer.lex"
+#line 255 "./util/configlexer.lex"
 { YDVAR(1, VAR_TLS_SESSION_TICKET_KEYS) }
 	YY_BREAK
 case 42:
 YY_RULE_SETUP
-#line 249 "./util/configlexer.lex"
+#line 256 "./util/configlexer.lex"
 { YDVAR(1, VAR_TLS_CIPHERS) }
 	YY_BREAK
 case 43:
 YY_RULE_SETUP
-#line 250 "./util/configlexer.lex"
+#line 257 "./util/configlexer.lex"
 { YDVAR(1, VAR_TLS_CIPHERSUITES) }
 	YY_BREAK
 case 44:
 YY_RULE_SETUP
-#line 251 "./util/configlexer.lex"
+#line 258 "./util/configlexer.lex"
 { YDVAR(1, VAR_TLS_USE_SNI) }
 	YY_BREAK
 case 45:
 YY_RULE_SETUP
-#line 252 "./util/configlexer.lex"
+#line 259 "./util/configlexer.lex"
 { YDVAR(1, VAR_HTTPS_PORT) }
 	YY_BREAK
 case 46:
 YY_RULE_SETUP
-#line 253 "./util/configlexer.lex"
+#line 260 "./util/configlexer.lex"
 { YDVAR(1, VAR_HTTP_ENDPOINT) }
 	YY_BREAK
 case 47:
 YY_RULE_SETUP
-#line 254 "./util/configlexer.lex"
+#line 261 "./util/configlexer.lex"
 { YDVAR(1, VAR_HTTP_MAX_STREAMS) }
 	YY_BREAK
 case 48:
 YY_RULE_SETUP
-#line 255 "./util/configlexer.lex"
+#line 262 "./util/configlexer.lex"
 { YDVAR(1, VAR_HTTP_QUERY_BUFFER_SIZE) }
 	YY_BREAK
 case 49:
 YY_RULE_SETUP
-#line 256 "./util/configlexer.lex"
+#line 263 "./util/configlexer.lex"
 { YDVAR(1, VAR_HTTP_RESPONSE_BUFFER_SIZE) }
 	YY_BREAK
 case 50:
 YY_RULE_SETUP
-#line 257 "./util/configlexer.lex"
+#line 264 "./util/configlexer.lex"
 { YDVAR(1, VAR_HTTP_NODELAY) }
 	YY_BREAK
 case 51:
 YY_RULE_SETUP
-#line 258 "./util/configlexer.lex"
+#line 265 "./util/configlexer.lex"
 { YDVAR(1, VAR_USE_SYSTEMD) }
 	YY_BREAK
 case 52:
 YY_RULE_SETUP
-#line 259 "./util/configlexer.lex"
+#line 266 "./util/configlexer.lex"
 { YDVAR(1, VAR_DO_DAEMONIZE) }
 	YY_BREAK
 case 53:
 YY_RULE_SETUP
-#line 260 "./util/configlexer.lex"
+#line 267 "./util/configlexer.lex"
 { YDVAR(1, VAR_INTERFACE) }
 	YY_BREAK
 case 54:
 YY_RULE_SETUP
-#line 261 "./util/configlexer.lex"
+#line 268 "./util/configlexer.lex"
 { YDVAR(1, VAR_INTERFACE) }
 	YY_BREAK
 case 55:
 YY_RULE_SETUP
-#line 262 "./util/configlexer.lex"
+#line 269 "./util/configlexer.lex"
 { YDVAR(1, VAR_OUTGOING_INTERFACE) }
 	YY_BREAK
 case 56:
 YY_RULE_SETUP
-#line 263 "./util/configlexer.lex"
+#line 270 "./util/configlexer.lex"
 { YDVAR(1, VAR_INTERFACE_AUTOMATIC) }
 	YY_BREAK
 case 57:
 YY_RULE_SETUP
-#line 264 "./util/configlexer.lex"
+#line 271 "./util/configlexer.lex"
 { YDVAR(1, VAR_SO_RCVBUF) }
 	YY_BREAK
 case 58:
 YY_RULE_SETUP
-#line 265 "./util/configlexer.lex"
+#line 272 "./util/configlexer.lex"
 { YDVAR(1, VAR_SO_SNDBUF) }
 	YY_BREAK
 case 59:
 YY_RULE_SETUP
-#line 266 "./util/configlexer.lex"
+#line 273 "./util/configlexer.lex"
 { YDVAR(1, VAR_SO_REUSEPORT) }
 	YY_BREAK
 case 60:
 YY_RULE_SETUP
-#line 267 "./util/configlexer.lex"
+#line 274 "./util/configlexer.lex"
 { YDVAR(1, VAR_IP_TRANSPARENT) }
 	YY_BREAK
 case 61:
 YY_RULE_SETUP
-#line 268 "./util/configlexer.lex"
+#line 275 "./util/configlexer.lex"
 { YDVAR(1, VAR_IP_FREEBIND) }
 	YY_BREAK
 case 62:
 YY_RULE_SETUP
-#line 269 "./util/configlexer.lex"
+#line 276 "./util/configlexer.lex"
 { YDVAR(1, VAR_IP_DSCP) }
 	YY_BREAK
 case 63:
 YY_RULE_SETUP
-#line 270 "./util/configlexer.lex"
+#line 277 "./util/configlexer.lex"
 { YDVAR(1, VAR_CHROOT) }
 	YY_BREAK
 case 64:
 YY_RULE_SETUP
-#line 271 "./util/configlexer.lex"
+#line 278 "./util/configlexer.lex"
 { YDVAR(1, VAR_USERNAME) }
 	YY_BREAK
 case 65:
 YY_RULE_SETUP
-#line 272 "./util/configlexer.lex"
+#line 279 "./util/configlexer.lex"
 { YDVAR(1, VAR_DIRECTORY) }
 	YY_BREAK
 case 66:
 YY_RULE_SETUP
-#line 273 "./util/configlexer.lex"
+#line 280 "./util/configlexer.lex"
 { YDVAR(1, VAR_LOGFILE) }
 	YY_BREAK
 case 67:
 YY_RULE_SETUP
-#line 274 "./util/configlexer.lex"
+#line 281 "./util/configlexer.lex"
 { YDVAR(1, VAR_PIDFILE) }
 	YY_BREAK
 case 68:
 YY_RULE_SETUP
-#line 275 "./util/configlexer.lex"
+#line 282 "./util/configlexer.lex"
 { YDVAR(1, VAR_ROOT_HINTS) }
 	YY_BREAK
 case 69:
 YY_RULE_SETUP
-#line 276 "./util/configlexer.lex"
+#line 283 "./util/configlexer.lex"
 { YDVAR(1, VAR_STREAM_WAIT_SIZE) }
 	YY_BREAK
 case 70:
 YY_RULE_SETUP
-#line 277 "./util/configlexer.lex"
+#line 284 "./util/configlexer.lex"
 { YDVAR(1, VAR_EDNS_BUFFER_SIZE) }
 	YY_BREAK
 case 71:
 YY_RULE_SETUP
-#line 278 "./util/configlexer.lex"
+#line 285 "./util/configlexer.lex"
 { YDVAR(1, VAR_MSG_BUFFER_SIZE) }
 	YY_BREAK
 case 72:
 YY_RULE_SETUP
-#line 279 "./util/configlexer.lex"
+#line 286 "./util/configlexer.lex"
 { YDVAR(1, VAR_MSG_CACHE_SIZE) }
 	YY_BREAK
 case 73:
 YY_RULE_SETUP
-#line 280 "./util/configlexer.lex"
+#line 287 "./util/configlexer.lex"
 { YDVAR(1, VAR_MSG_CACHE_SLABS) }
 	YY_BREAK
 case 74:
 YY_RULE_SETUP
-#line 281 "./util/configlexer.lex"
+#line 288 "./util/configlexer.lex"
 { YDVAR(1, VAR_RRSET_CACHE_SIZE) }
 	YY_BREAK
 case 75:
 YY_RULE_SETUP
-#line 282 "./util/configlexer.lex"
+#line 289 "./util/configlexer.lex"
 { YDVAR(1, VAR_RRSET_CACHE_SLABS) }
 	YY_BREAK
 case 76:
 YY_RULE_SETUP
-#line 283 "./util/configlexer.lex"
+#line 290 "./util/configlexer.lex"
 { YDVAR(1, VAR_CACHE_MAX_TTL) }
 	YY_BREAK
 case 77:
 YY_RULE_SETUP
-#line 284 "./util/configlexer.lex"
+#line 291 "./util/configlexer.lex"
 { YDVAR(1, VAR_CACHE_MAX_NEGATIVE_TTL) }
 	YY_BREAK
 case 78:
 YY_RULE_SETUP
-#line 285 "./util/configlexer.lex"
+#line 292 "./util/configlexer.lex"
 { YDVAR(1, VAR_CACHE_MIN_TTL) }
 	YY_BREAK
 case 79:
 YY_RULE_SETUP
-#line 286 "./util/configlexer.lex"
+#line 293 "./util/configlexer.lex"
 { YDVAR(1, VAR_INFRA_HOST_TTL) }
 	YY_BREAK
 case 80:
 YY_RULE_SETUP
-#line 287 "./util/configlexer.lex"
+#line 294 "./util/configlexer.lex"
 { YDVAR(1, VAR_INFRA_LAME_TTL) }
 	YY_BREAK
 case 81:
 YY_RULE_SETUP
-#line 288 "./util/configlexer.lex"
+#line 295 "./util/configlexer.lex"
 { YDVAR(1, VAR_INFRA_CACHE_SLABS) }
 	YY_BREAK
 case 82:
 YY_RULE_SETUP
-#line 289 "./util/configlexer.lex"
+#line 296 "./util/configlexer.lex"
 { YDVAR(1, VAR_INFRA_CACHE_NUMHOSTS) }
 	YY_BREAK
 case 83:
 YY_RULE_SETUP
-#line 290 "./util/configlexer.lex"
+#line 297 "./util/configlexer.lex"
 { YDVAR(1, VAR_INFRA_CACHE_LAME_SIZE) }
 	YY_BREAK
 case 84:
 YY_RULE_SETUP
-#line 291 "./util/configlexer.lex"
+#line 298 "./util/configlexer.lex"
 { YDVAR(1, VAR_INFRA_CACHE_MIN_RTT) }
 	YY_BREAK
 case 85:
 YY_RULE_SETUP
-#line 292 "./util/configlexer.lex"
+#line 299 "./util/configlexer.lex"
 { YDVAR(1, VAR_NUM_QUERIES_PER_THREAD) }
 	YY_BREAK
 case 86:
 YY_RULE_SETUP
-#line 293 "./util/configlexer.lex"
+#line 300 "./util/configlexer.lex"
 { YDVAR(1, VAR_JOSTLE_TIMEOUT) }
 	YY_BREAK
 case 87:
 YY_RULE_SETUP
-#line 294 "./util/configlexer.lex"
+#line 301 "./util/configlexer.lex"
 { YDVAR(1, VAR_DELAY_CLOSE) }
 	YY_BREAK
 case 88:
 YY_RULE_SETUP
-#line 295 "./util/configlexer.lex"
+#line 302 "./util/configlexer.lex"
 { YDVAR(1, VAR_TARGET_FETCH_POLICY) }
 	YY_BREAK
 case 89:
 YY_RULE_SETUP
-#line 296 "./util/configlexer.lex"
+#line 303 "./util/configlexer.lex"
 { YDVAR(1, VAR_HARDEN_SHORT_BUFSIZE) }
 	YY_BREAK
 case 90:
 YY_RULE_SETUP
-#line 297 "./util/configlexer.lex"
+#line 304 "./util/configlexer.lex"
 { YDVAR(1, VAR_HARDEN_LARGE_QUERIES) }
 	YY_BREAK
 case 91:
 YY_RULE_SETUP
-#line 298 "./util/configlexer.lex"
+#line 305 "./util/configlexer.lex"
 { YDVAR(1, VAR_HARDEN_GLUE) }
 	YY_BREAK
 case 92:
 YY_RULE_SETUP
-#line 299 "./util/configlexer.lex"
+#line 306 "./util/configlexer.lex"
 { YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) }
 	YY_BREAK
 case 93:
 YY_RULE_SETUP
-#line 300 "./util/configlexer.lex"
+#line 307 "./util/configlexer.lex"
 { YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
 	YY_BREAK
 case 94:
 YY_RULE_SETUP
-#line 301 "./util/configlexer.lex"
+#line 308 "./util/configlexer.lex"
 { YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
 	YY_BREAK
 case 95:
 YY_RULE_SETUP
-#line 302 "./util/configlexer.lex"
+#line 309 "./util/configlexer.lex"
 { YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
 	YY_BREAK
 case 96:
 YY_RULE_SETUP
-#line 303 "./util/configlexer.lex"
+#line 310 "./util/configlexer.lex"
 { YDVAR(1, VAR_USE_CAPS_FOR_ID) }
 	YY_BREAK
 case 97:
 YY_RULE_SETUP
-#line 304 "./util/configlexer.lex"
+#line 311 "./util/configlexer.lex"
 { YDVAR(1, VAR_CAPS_WHITELIST) }
 	YY_BREAK
 case 98:
 YY_RULE_SETUP
-#line 305 "./util/configlexer.lex"
+#line 312 "./util/configlexer.lex"
 { YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
 	YY_BREAK
 case 99:
 YY_RULE_SETUP
-#line 306 "./util/configlexer.lex"
+#line 313 "./util/configlexer.lex"
 { YDVAR(1, VAR_PRIVATE_ADDRESS) }
 	YY_BREAK
 case 100:
 YY_RULE_SETUP
-#line 307 "./util/configlexer.lex"
+#line 314 "./util/configlexer.lex"
 { YDVAR(1, VAR_PRIVATE_DOMAIN) }
 	YY_BREAK
 case 101:
 YY_RULE_SETUP
-#line 308 "./util/configlexer.lex"
+#line 315 "./util/configlexer.lex"
 { YDVAR(1, VAR_PREFETCH_KEY) }
 	YY_BREAK
 case 102:
 YY_RULE_SETUP
-#line 309 "./util/configlexer.lex"
+#line 316 "./util/configlexer.lex"
 { YDVAR(1, VAR_PREFETCH) }
 	YY_BREAK
 case 103:
 YY_RULE_SETUP
-#line 310 "./util/configlexer.lex"
+#line 317 "./util/configlexer.lex"
 { YDVAR(1, VAR_DENY_ANY) }
 	YY_BREAK
 case 104:
 YY_RULE_SETUP
-#line 311 "./util/configlexer.lex"
+#line 318 "./util/configlexer.lex"
 { YDVAR(0, VAR_STUB_ZONE) }
 	YY_BREAK
 case 105:
 YY_RULE_SETUP
-#line 312 "./util/configlexer.lex"
+#line 319 "./util/configlexer.lex"
 { YDVAR(1, VAR_NAME) }
 	YY_BREAK
 case 106:
 YY_RULE_SETUP
-#line 313 "./util/configlexer.lex"
+#line 320 "./util/configlexer.lex"
 { YDVAR(1, VAR_STUB_ADDR) }
 	YY_BREAK
 case 107:
 YY_RULE_SETUP
-#line 314 "./util/configlexer.lex"
+#line 321 "./util/configlexer.lex"
 { YDVAR(1, VAR_STUB_HOST) }
 	YY_BREAK
 case 108:
 YY_RULE_SETUP
-#line 315 "./util/configlexer.lex"
+#line 322 "./util/configlexer.lex"
 { YDVAR(1, VAR_STUB_PRIME) }
 	YY_BREAK
 case 109:
 YY_RULE_SETUP
-#line 316 "./util/configlexer.lex"
+#line 323 "./util/configlexer.lex"
 { YDVAR(1, VAR_STUB_FIRST) }
 	YY_BREAK
 case 110:
 YY_RULE_SETUP
-#line 317 "./util/configlexer.lex"
+#line 324 "./util/configlexer.lex"
 { YDVAR(1, VAR_STUB_NO_CACHE) }
 	YY_BREAK
 case 111:
 YY_RULE_SETUP
-#line 318 "./util/configlexer.lex"
+#line 325 "./util/configlexer.lex"
 { YDVAR(1, VAR_STUB_SSL_UPSTREAM) }
 	YY_BREAK
 case 112:
 YY_RULE_SETUP
-#line 319 "./util/configlexer.lex"
+#line 326 "./util/configlexer.lex"
 { YDVAR(1, VAR_STUB_SSL_UPSTREAM) }
 	YY_BREAK
 case 113:
 YY_RULE_SETUP
-#line 320 "./util/configlexer.lex"
+#line 327 "./util/configlexer.lex"
 { YDVAR(0, VAR_FORWARD_ZONE) }
 	YY_BREAK
 case 114:
 YY_RULE_SETUP
-#line 321 "./util/configlexer.lex"
+#line 328 "./util/configlexer.lex"
 { YDVAR(1, VAR_FORWARD_ADDR) }
 	YY_BREAK
 case 115:
 YY_RULE_SETUP
-#line 322 "./util/configlexer.lex"
+#line 329 "./util/configlexer.lex"
 { YDVAR(1, VAR_FORWARD_HOST) }
 	YY_BREAK
 case 116:
 YY_RULE_SETUP
-#line 323 "./util/configlexer.lex"
+#line 330 "./util/configlexer.lex"
 { YDVAR(1, VAR_FORWARD_FIRST) }
 	YY_BREAK
 case 117:
 YY_RULE_SETUP
-#line 324 "./util/configlexer.lex"
+#line 331 "./util/configlexer.lex"
 { YDVAR(1, VAR_FORWARD_NO_CACHE) }
 	YY_BREAK
 case 118:
 YY_RULE_SETUP
-#line 325 "./util/configlexer.lex"
+#line 332 "./util/configlexer.lex"
 { YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) }
 	YY_BREAK
 case 119:
 YY_RULE_SETUP
-#line 326 "./util/configlexer.lex"
+#line 333 "./util/configlexer.lex"
 { YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) }
 	YY_BREAK
 case 120:
 YY_RULE_SETUP
-#line 327 "./util/configlexer.lex"
+#line 334 "./util/configlexer.lex"
 { YDVAR(0, VAR_AUTH_ZONE) }
 	YY_BREAK
 case 121:
 YY_RULE_SETUP
-#line 328 "./util/configlexer.lex"
+#line 335 "./util/configlexer.lex"
 { YDVAR(0, VAR_RPZ) }
 	YY_BREAK
 case 122:
 YY_RULE_SETUP
-#line 329 "./util/configlexer.lex"
+#line 336 "./util/configlexer.lex"
 { YDVAR(1, VAR_TAGS) }
 	YY_BREAK
 case 123:
 YY_RULE_SETUP
-#line 330 "./util/configlexer.lex"
+#line 337 "./util/configlexer.lex"
 { YDVAR(1, VAR_RPZ_ACTION_OVERRIDE) }
 	YY_BREAK
 case 124:
 YY_RULE_SETUP
-#line 331 "./util/configlexer.lex"
+#line 338 "./util/configlexer.lex"
 { YDVAR(1, VAR_RPZ_CNAME_OVERRIDE) }
 	YY_BREAK
 case 125:
 YY_RULE_SETUP
-#line 332 "./util/configlexer.lex"
+#line 339 "./util/configlexer.lex"
 { YDVAR(1, VAR_RPZ_LOG) }
 	YY_BREAK
 case 126:
 YY_RULE_SETUP
-#line 333 "./util/configlexer.lex"
+#line 340 "./util/configlexer.lex"
 { YDVAR(1, VAR_RPZ_LOG_NAME) }
 	YY_BREAK
 case 127:
 YY_RULE_SETUP
-#line 334 "./util/configlexer.lex"
+#line 341 "./util/configlexer.lex"
 { YDVAR(1, VAR_ZONEFILE) }
 	YY_BREAK
 case 128:
 YY_RULE_SETUP
-#line 335 "./util/configlexer.lex"
+#line 342 "./util/configlexer.lex"
 { YDVAR(1, VAR_MASTER) }
 	YY_BREAK
 case 129:
 YY_RULE_SETUP
-#line 336 "./util/configlexer.lex"
+#line 343 "./util/configlexer.lex"
 { YDVAR(1, VAR_URL) }
 	YY_BREAK
 case 130:
 YY_RULE_SETUP
-#line 337 "./util/configlexer.lex"
+#line 344 "./util/configlexer.lex"
 { YDVAR(1, VAR_ALLOW_NOTIFY) }
 	YY_BREAK
 case 131:
 YY_RULE_SETUP
-#line 338 "./util/configlexer.lex"
+#line 345 "./util/configlexer.lex"
 { YDVAR(1, VAR_FOR_DOWNSTREAM) }
 	YY_BREAK
 case 132:
 YY_RULE_SETUP
-#line 339 "./util/configlexer.lex"
+#line 346 "./util/configlexer.lex"
 { YDVAR(1, VAR_FOR_UPSTREAM) }
 	YY_BREAK
 case 133:
 YY_RULE_SETUP
-#line 340 "./util/configlexer.lex"
+#line 347 "./util/configlexer.lex"
 { YDVAR(1, VAR_FALLBACK_ENABLED) }
 	YY_BREAK
 case 134:
 YY_RULE_SETUP
-#line 341 "./util/configlexer.lex"
+#line 348 "./util/configlexer.lex"
 { YDVAR(0, VAR_VIEW) }
 	YY_BREAK
 case 135:
 YY_RULE_SETUP
-#line 342 "./util/configlexer.lex"
+#line 349 "./util/configlexer.lex"
 { YDVAR(1, VAR_VIEW_FIRST) }
 	YY_BREAK
 case 136:
 YY_RULE_SETUP
-#line 343 "./util/configlexer.lex"
+#line 350 "./util/configlexer.lex"
 { YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
 	YY_BREAK
 case 137:
 YY_RULE_SETUP
-#line 344 "./util/configlexer.lex"
+#line 351 "./util/configlexer.lex"
 { YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
 	YY_BREAK
 case 138:
 YY_RULE_SETUP
-#line 345 "./util/configlexer.lex"
+#line 352 "./util/configlexer.lex"
 { YDVAR(2, VAR_ACCESS_CONTROL) }
 	YY_BREAK
 case 139:
 YY_RULE_SETUP
-#line 346 "./util/configlexer.lex"
+#line 353 "./util/configlexer.lex"
 { YDVAR(1, VAR_SEND_CLIENT_SUBNET) }
 	YY_BREAK
 case 140:
 YY_RULE_SETUP
-#line 347 "./util/configlexer.lex"
+#line 354 "./util/configlexer.lex"
 { YDVAR(1, VAR_CLIENT_SUBNET_ZONE) }
 	YY_BREAK
 case 141:
 YY_RULE_SETUP
-#line 348 "./util/configlexer.lex"
+#line 355 "./util/configlexer.lex"
 { YDVAR(1, VAR_CLIENT_SUBNET_ALWAYS_FORWARD) }
 	YY_BREAK
 case 142:
 YY_RULE_SETUP
-#line 349 "./util/configlexer.lex"
+#line 356 "./util/configlexer.lex"
 { YDVAR(1, VAR_CLIENT_SUBNET_OPCODE) }
 	YY_BREAK
 case 143:
 YY_RULE_SETUP
-#line 350 "./util/configlexer.lex"
+#line 357 "./util/configlexer.lex"
 { YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV4) }
 	YY_BREAK
 case 144:
 YY_RULE_SETUP
-#line 351 "./util/configlexer.lex"
+#line 358 "./util/configlexer.lex"
 { YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV6) }
 	YY_BREAK
 case 145:
 YY_RULE_SETUP
-#line 352 "./util/configlexer.lex"
+#line 359 "./util/configlexer.lex"
 { YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV4) }
 	YY_BREAK
 case 146:
 YY_RULE_SETUP
-#line 353 "./util/configlexer.lex"
+#line 360 "./util/configlexer.lex"
 { YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV6) }
 	YY_BREAK
 case 147:
 YY_RULE_SETUP
-#line 354 "./util/configlexer.lex"
+#line 361 "./util/configlexer.lex"
 { YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV4) }
 	YY_BREAK
 case 148:
 YY_RULE_SETUP
-#line 355 "./util/configlexer.lex"
+#line 362 "./util/configlexer.lex"
 { YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV6) }
 	YY_BREAK
 case 149:
 YY_RULE_SETUP
-#line 356 "./util/configlexer.lex"
+#line 363 "./util/configlexer.lex"
 { YDVAR(1, VAR_HIDE_IDENTITY) }
 	YY_BREAK
 case 150:
 YY_RULE_SETUP
-#line 357 "./util/configlexer.lex"
+#line 364 "./util/configlexer.lex"
 { YDVAR(1, VAR_HIDE_VERSION) }
 	YY_BREAK
 case 151:
 YY_RULE_SETUP
-#line 358 "./util/configlexer.lex"
+#line 365 "./util/configlexer.lex"
 { YDVAR(1, VAR_HIDE_TRUSTANCHOR) }
 	YY_BREAK
 case 152:
 YY_RULE_SETUP
-#line 359 "./util/configlexer.lex"
+#line 366 "./util/configlexer.lex"
 { YDVAR(1, VAR_IDENTITY) }
 	YY_BREAK
 case 153:
 YY_RULE_SETUP
-#line 360 "./util/configlexer.lex"
+#line 367 "./util/configlexer.lex"
 { YDVAR(1, VAR_VERSION) }
 	YY_BREAK
 case 154:
 YY_RULE_SETUP
-#line 361 "./util/configlexer.lex"
+#line 368 "./util/configlexer.lex"
 { YDVAR(1, VAR_MODULE_CONF) }
 	YY_BREAK
 case 155:
 YY_RULE_SETUP
-#line 362 "./util/configlexer.lex"
+#line 369 "./util/configlexer.lex"
 { YDVAR(1, VAR_DLV_ANCHOR) }
 	YY_BREAK
 case 156:
 YY_RULE_SETUP
-#line 363 "./util/configlexer.lex"
+#line 370 "./util/configlexer.lex"
 { YDVAR(1, VAR_DLV_ANCHOR_FILE) }
 	YY_BREAK
 case 157:
 YY_RULE_SETUP
-#line 364 "./util/configlexer.lex"
+#line 371 "./util/configlexer.lex"
 { YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
 	YY_BREAK
 case 158:
 YY_RULE_SETUP
-#line 365 "./util/configlexer.lex"
+#line 372 "./util/configlexer.lex"
 { YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
 	YY_BREAK
 case 159:
 YY_RULE_SETUP
-#line 366 "./util/configlexer.lex"
+#line 373 "./util/configlexer.lex"
 { YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
 	YY_BREAK
 case 160:
 YY_RULE_SETUP
-#line 367 "./util/configlexer.lex"
+#line 374 "./util/configlexer.lex"
 { YDVAR(1, VAR_TRUST_ANCHOR) }
 	YY_BREAK
 case 161:
 YY_RULE_SETUP
-#line 368 "./util/configlexer.lex"
+#line 375 "./util/configlexer.lex"
 { YDVAR(1, VAR_TRUST_ANCHOR_SIGNALING) }
 	YY_BREAK
 case 162:
 YY_RULE_SETUP
-#line 369 "./util/configlexer.lex"
+#line 376 "./util/configlexer.lex"
 { YDVAR(1, VAR_ROOT_KEY_SENTINEL) }
 	YY_BREAK
 case 163:
 YY_RULE_SETUP
-#line 370 "./util/configlexer.lex"
+#line 377 "./util/configlexer.lex"
 { YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
 	YY_BREAK
 case 164:
 YY_RULE_SETUP
-#line 371 "./util/configlexer.lex"
+#line 378 "./util/configlexer.lex"
 { YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
 	YY_BREAK
 case 165:
 YY_RULE_SETUP
-#line 372 "./util/configlexer.lex"
+#line 379 "./util/configlexer.lex"
 { YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
 	YY_BREAK
 case 166:
 YY_RULE_SETUP
-#line 373 "./util/configlexer.lex"
+#line 380 "./util/configlexer.lex"
 { YDVAR(1, VAR_BOGUS_TTL) }
 	YY_BREAK
 case 167:
 YY_RULE_SETUP
-#line 374 "./util/configlexer.lex"
+#line 381 "./util/configlexer.lex"
 { YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
 	YY_BREAK
 case 168:
 YY_RULE_SETUP
-#line 375 "./util/configlexer.lex"
+#line 382 "./util/configlexer.lex"
 { YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
 	YY_BREAK
 case 169:
 YY_RULE_SETUP
-#line 376 "./util/configlexer.lex"
+#line 383 "./util/configlexer.lex"
 { YDVAR(1, VAR_AGGRESSIVE_NSEC) }
 	YY_BREAK
 case 170:
 YY_RULE_SETUP
-#line 377 "./util/configlexer.lex"
+#line 384 "./util/configlexer.lex"
 { YDVAR(1, VAR_IGNORE_CD_FLAG) }
 	YY_BREAK
 case 171:
 YY_RULE_SETUP
-#line 378 "./util/configlexer.lex"
+#line 385 "./util/configlexer.lex"
 { YDVAR(1, VAR_SERVE_EXPIRED) }
 	YY_BREAK
 case 172:
 YY_RULE_SETUP
-#line 379 "./util/configlexer.lex"
+#line 386 "./util/configlexer.lex"
 { YDVAR(1, VAR_SERVE_EXPIRED_TTL) }
 	YY_BREAK
 case 173:
 YY_RULE_SETUP
-#line 380 "./util/configlexer.lex"
+#line 387 "./util/configlexer.lex"
 { YDVAR(1, VAR_SERVE_EXPIRED_TTL_RESET) }
 	YY_BREAK
 case 174:
 YY_RULE_SETUP
-#line 381 "./util/configlexer.lex"
+#line 388 "./util/configlexer.lex"
 { YDVAR(1, VAR_SERVE_EXPIRED_REPLY_TTL) }
 	YY_BREAK
 case 175:
 YY_RULE_SETUP
-#line 382 "./util/configlexer.lex"
+#line 389 "./util/configlexer.lex"
 { YDVAR(1, VAR_SERVE_EXPIRED_CLIENT_TIMEOUT) }
 	YY_BREAK
 case 176:
 YY_RULE_SETUP
-#line 383 "./util/configlexer.lex"
+#line 390 "./util/configlexer.lex"
 { YDVAR(1, VAR_FAKE_DSA) }
 	YY_BREAK
 case 177:
 YY_RULE_SETUP
-#line 384 "./util/configlexer.lex"
+#line 391 "./util/configlexer.lex"
 { YDVAR(1, VAR_FAKE_SHA1) }
 	YY_BREAK
 case 178:
 YY_RULE_SETUP
-#line 385 "./util/configlexer.lex"
+#line 392 "./util/configlexer.lex"
 { YDVAR(1, VAR_VAL_LOG_LEVEL) }
 	YY_BREAK
 case 179:
 YY_RULE_SETUP
-#line 386 "./util/configlexer.lex"
+#line 393 "./util/configlexer.lex"
 { YDVAR(1, VAR_KEY_CACHE_SIZE) }
 	YY_BREAK
 case 180:
 YY_RULE_SETUP
-#line 387 "./util/configlexer.lex"
+#line 394 "./util/configlexer.lex"
 { YDVAR(1, VAR_KEY_CACHE_SLABS) }
 	YY_BREAK
 case 181:
 YY_RULE_SETUP
-#line 388 "./util/configlexer.lex"
+#line 395 "./util/configlexer.lex"
 { YDVAR(1, VAR_NEG_CACHE_SIZE) }
 	YY_BREAK
 case 182:
 YY_RULE_SETUP
-#line 389 "./util/configlexer.lex"
+#line 396 "./util/configlexer.lex"
 { 
 				  YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
 	YY_BREAK
 case 183:
 YY_RULE_SETUP
-#line 391 "./util/configlexer.lex"
+#line 398 "./util/configlexer.lex"
 { YDVAR(1, VAR_ADD_HOLDDOWN) }
 	YY_BREAK
 case 184:
 YY_RULE_SETUP
-#line 392 "./util/configlexer.lex"
+#line 399 "./util/configlexer.lex"
 { YDVAR(1, VAR_DEL_HOLDDOWN) }
 	YY_BREAK
 case 185:
 YY_RULE_SETUP
-#line 393 "./util/configlexer.lex"
+#line 400 "./util/configlexer.lex"
 { YDVAR(1, VAR_KEEP_MISSING) }
 	YY_BREAK
 case 186:
 YY_RULE_SETUP
-#line 394 "./util/configlexer.lex"
+#line 401 "./util/configlexer.lex"
 { YDVAR(1, VAR_PERMIT_SMALL_HOLDDOWN) }
 	YY_BREAK
 case 187:
 YY_RULE_SETUP
-#line 395 "./util/configlexer.lex"
+#line 402 "./util/configlexer.lex"
 { YDVAR(1, VAR_USE_SYSLOG) }
 	YY_BREAK
 case 188:
 YY_RULE_SETUP
-#line 396 "./util/configlexer.lex"
+#line 403 "./util/configlexer.lex"
 { YDVAR(1, VAR_LOG_IDENTITY) }
 	YY_BREAK
 case 189:
 YY_RULE_SETUP
-#line 397 "./util/configlexer.lex"
+#line 404 "./util/configlexer.lex"
 { YDVAR(1, VAR_LOG_TIME_ASCII) }
 	YY_BREAK
 case 190:
 YY_RULE_SETUP
-#line 398 "./util/configlexer.lex"
+#line 405 "./util/configlexer.lex"
 { YDVAR(1, VAR_LOG_QUERIES) }
 	YY_BREAK
 case 191:
 YY_RULE_SETUP
-#line 399 "./util/configlexer.lex"
+#line 406 "./util/configlexer.lex"
 { YDVAR(1, VAR_LOG_REPLIES) }
 	YY_BREAK
 case 192:
 YY_RULE_SETUP
-#line 400 "./util/configlexer.lex"
+#line 407 "./util/configlexer.lex"
 { YDVAR(1, VAR_LOG_TAG_QUERYREPLY) }
 	YY_BREAK
 case 193:
 YY_RULE_SETUP
-#line 401 "./util/configlexer.lex"
+#line 408 "./util/configlexer.lex"
 { YDVAR(1, VAR_LOG_LOCAL_ACTIONS) }
 	YY_BREAK
 case 194:
 YY_RULE_SETUP
-#line 402 "./util/configlexer.lex"
+#line 409 "./util/configlexer.lex"
 { YDVAR(1, VAR_LOG_SERVFAIL) }
 	YY_BREAK
 case 195:
 YY_RULE_SETUP
-#line 403 "./util/configlexer.lex"
+#line 410 "./util/configlexer.lex"
 { YDVAR(2, VAR_LOCAL_ZONE) }
 	YY_BREAK
 case 196:
 YY_RULE_SETUP
-#line 404 "./util/configlexer.lex"
+#line 411 "./util/configlexer.lex"
 { YDVAR(1, VAR_LOCAL_DATA) }
 	YY_BREAK
 case 197:
 YY_RULE_SETUP
-#line 405 "./util/configlexer.lex"
+#line 412 "./util/configlexer.lex"
 { YDVAR(1, VAR_LOCAL_DATA_PTR) }
 	YY_BREAK
 case 198:
 YY_RULE_SETUP
-#line 406 "./util/configlexer.lex"
+#line 413 "./util/configlexer.lex"
 { YDVAR(1, VAR_UNBLOCK_LAN_ZONES) }
 	YY_BREAK
 case 199:
 YY_RULE_SETUP
-#line 407 "./util/configlexer.lex"
+#line 414 "./util/configlexer.lex"
 { YDVAR(1, VAR_INSECURE_LAN_ZONES) }
 	YY_BREAK
 case 200:
 YY_RULE_SETUP
-#line 408 "./util/configlexer.lex"
+#line 415 "./util/configlexer.lex"
 { YDVAR(1, VAR_STATISTICS_INTERVAL) }
 	YY_BREAK
 case 201:
 YY_RULE_SETUP
-#line 409 "./util/configlexer.lex"
+#line 416 "./util/configlexer.lex"
 { YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
 	YY_BREAK
 case 202:
 YY_RULE_SETUP
-#line 410 "./util/configlexer.lex"
+#line 417 "./util/configlexer.lex"
 { YDVAR(1, VAR_EXTENDED_STATISTICS) }
 	YY_BREAK
 case 203:
 YY_RULE_SETUP
-#line 411 "./util/configlexer.lex"
+#line 418 "./util/configlexer.lex"
 { YDVAR(1, VAR_SHM_ENABLE) }
 	YY_BREAK
 case 204:
 YY_RULE_SETUP
-#line 412 "./util/configlexer.lex"
+#line 419 "./util/configlexer.lex"
 { YDVAR(1, VAR_SHM_KEY) }
 	YY_BREAK
 case 205:
 YY_RULE_SETUP
-#line 413 "./util/configlexer.lex"
+#line 420 "./util/configlexer.lex"
 { YDVAR(0, VAR_REMOTE_CONTROL) }
 	YY_BREAK
 case 206:
 YY_RULE_SETUP
-#line 414 "./util/configlexer.lex"
+#line 421 "./util/configlexer.lex"
 { YDVAR(1, VAR_CONTROL_ENABLE) }
 	YY_BREAK
 case 207:
 YY_RULE_SETUP
-#line 415 "./util/configlexer.lex"
+#line 422 "./util/configlexer.lex"
 { YDVAR(1, VAR_CONTROL_INTERFACE) }
 	YY_BREAK
 case 208:
 YY_RULE_SETUP
-#line 416 "./util/configlexer.lex"
+#line 423 "./util/configlexer.lex"
 { YDVAR(1, VAR_CONTROL_PORT) }
 	YY_BREAK
 case 209:
 YY_RULE_SETUP
-#line 417 "./util/configlexer.lex"
+#line 424 "./util/configlexer.lex"
 { YDVAR(1, VAR_CONTROL_USE_CERT) }
 	YY_BREAK
 case 210:
 YY_RULE_SETUP
-#line 418 "./util/configlexer.lex"
+#line 425 "./util/configlexer.lex"
 { YDVAR(1, VAR_SERVER_KEY_FILE) }
 	YY_BREAK
 case 211:
 YY_RULE_SETUP
-#line 419 "./util/configlexer.lex"
+#line 426 "./util/configlexer.lex"
 { YDVAR(1, VAR_SERVER_CERT_FILE) }
 	YY_BREAK
 case 212:
 YY_RULE_SETUP
-#line 420 "./util/configlexer.lex"
+#line 427 "./util/configlexer.lex"
 { YDVAR(1, VAR_CONTROL_KEY_FILE) }
 	YY_BREAK
 case 213:
 YY_RULE_SETUP
-#line 421 "./util/configlexer.lex"
+#line 428 "./util/configlexer.lex"
 { YDVAR(1, VAR_CONTROL_CERT_FILE) }
 	YY_BREAK
 case 214:
 YY_RULE_SETUP
-#line 422 "./util/configlexer.lex"
+#line 429 "./util/configlexer.lex"
 { YDVAR(1, VAR_PYTHON_SCRIPT) }
 	YY_BREAK
 case 215:
 YY_RULE_SETUP
-#line 423 "./util/configlexer.lex"
+#line 430 "./util/configlexer.lex"
 { YDVAR(0, VAR_PYTHON) }
 	YY_BREAK
 case 216:
 YY_RULE_SETUP
-#line 424 "./util/configlexer.lex"
+#line 431 "./util/configlexer.lex"
 { YDVAR(1, VAR_DYNLIB_FILE) }
 	YY_BREAK
 case 217:
 YY_RULE_SETUP
-#line 425 "./util/configlexer.lex"
+#line 432 "./util/configlexer.lex"
 { YDVAR(0, VAR_DYNLIB) }
 	YY_BREAK
 case 218:
 YY_RULE_SETUP
-#line 426 "./util/configlexer.lex"
+#line 433 "./util/configlexer.lex"
 { YDVAR(1, VAR_DOMAIN_INSECURE) }
 	YY_BREAK
 case 219:
 YY_RULE_SETUP
-#line 427 "./util/configlexer.lex"
+#line 434 "./util/configlexer.lex"
 { YDVAR(1, VAR_MINIMAL_RESPONSES) }
 	YY_BREAK
 case 220:
 YY_RULE_SETUP
-#line 428 "./util/configlexer.lex"
+#line 435 "./util/configlexer.lex"
 { YDVAR(1, VAR_RRSET_ROUNDROBIN) }
 	YY_BREAK
 case 221:
 YY_RULE_SETUP
-#line 429 "./util/configlexer.lex"
+#line 436 "./util/configlexer.lex"
 { YDVAR(1, VAR_UNKNOWN_SERVER_TIME_LIMIT) }
 	YY_BREAK
 case 222:
 YY_RULE_SETUP
-#line 430 "./util/configlexer.lex"
+#line 437 "./util/configlexer.lex"
 { YDVAR(1, VAR_MAX_UDP_SIZE) }
 	YY_BREAK
 case 223:
 YY_RULE_SETUP
-#line 431 "./util/configlexer.lex"
+#line 438 "./util/configlexer.lex"
 { YDVAR(1, VAR_DNS64_PREFIX) }
 	YY_BREAK
 case 224:
 YY_RULE_SETUP
-#line 432 "./util/configlexer.lex"
+#line 439 "./util/configlexer.lex"
 { YDVAR(1, VAR_DNS64_SYNTHALL) }
 	YY_BREAK
 case 225:
 YY_RULE_SETUP
-#line 433 "./util/configlexer.lex"
+#line 440 "./util/configlexer.lex"
 { YDVAR(1, VAR_DNS64_IGNORE_AAAA) }
 	YY_BREAK
 case 226:
 YY_RULE_SETUP
-#line 434 "./util/configlexer.lex"
+#line 441 "./util/configlexer.lex"
 { YDVAR(1, VAR_DEFINE_TAG) }
 	YY_BREAK
 case 227:
 YY_RULE_SETUP
-#line 435 "./util/configlexer.lex"
+#line 442 "./util/configlexer.lex"
 { YDVAR(2, VAR_LOCAL_ZONE_TAG) }
 	YY_BREAK
 case 228:
 YY_RULE_SETUP
-#line 436 "./util/configlexer.lex"
+#line 443 "./util/configlexer.lex"
 { YDVAR(2, VAR_ACCESS_CONTROL_TAG) }
 	YY_BREAK
 case 229:
 YY_RULE_SETUP
-#line 437 "./util/configlexer.lex"
+#line 444 "./util/configlexer.lex"
 { YDVAR(3, VAR_ACCESS_CONTROL_TAG_ACTION) }
 	YY_BREAK
 case 230:
 YY_RULE_SETUP
-#line 438 "./util/configlexer.lex"
+#line 445 "./util/configlexer.lex"
 { YDVAR(3, VAR_ACCESS_CONTROL_TAG_DATA) }
 	YY_BREAK
 case 231:
 YY_RULE_SETUP
-#line 439 "./util/configlexer.lex"
+#line 446 "./util/configlexer.lex"
 { YDVAR(2, VAR_ACCESS_CONTROL_VIEW) }
 	YY_BREAK
 case 232:
 YY_RULE_SETUP
-#line 440 "./util/configlexer.lex"
+#line 447 "./util/configlexer.lex"
 { YDVAR(3, VAR_LOCAL_ZONE_OVERRIDE) }
 	YY_BREAK
 case 233:
 YY_RULE_SETUP
-#line 441 "./util/configlexer.lex"
+#line 448 "./util/configlexer.lex"
 { YDVAR(0, VAR_DNSTAP) }
 	YY_BREAK
 case 234:
 YY_RULE_SETUP
-#line 442 "./util/configlexer.lex"
+#line 449 "./util/configlexer.lex"
 { YDVAR(1, VAR_DNSTAP_ENABLE) }
 	YY_BREAK
 case 235:
 YY_RULE_SETUP
-#line 443 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
+#line 450 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_BIDIRECTIONAL) }
 	YY_BREAK
 case 236:
 YY_RULE_SETUP
-#line 444 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_IP) }
+#line 451 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
 	YY_BREAK
 case 237:
 YY_RULE_SETUP
-#line 445 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_TLS) }
+#line 452 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_IP) }
 	YY_BREAK
 case 238:
 YY_RULE_SETUP
-#line 446 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_TLS_SERVER_NAME) }
+#line 453 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_TLS) }
 	YY_BREAK
 case 239:
 YY_RULE_SETUP
-#line 447 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_TLS_CERT_BUNDLE) }
+#line 454 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_TLS_SERVER_NAME) }
 	YY_BREAK
 case 240:
 YY_RULE_SETUP
-#line 448 "./util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_TLS_CLIENT_KEY_FILE) }
+#line 455 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_TLS_CERT_BUNDLE) }
 	YY_BREAK
 case 241:
 YY_RULE_SETUP
-#line 450 "./util/configlexer.lex"
+#line 456 "./util/configlexer.lex"
 {
-		YDVAR(1, VAR_DNSTAP_TLS_CLIENT_CERT_FILE) }
+		YDVAR(1, VAR_DNSTAP_TLS_CLIENT_KEY_FILE) }
 	YY_BREAK
 case 242:
 YY_RULE_SETUP
-#line 452 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
+#line 458 "./util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_TLS_CLIENT_CERT_FILE) }
 	YY_BREAK
 case 243:
 YY_RULE_SETUP
-#line 453 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
+#line 460 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
 	YY_BREAK
 case 244:
 YY_RULE_SETUP
-#line 454 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_IDENTITY) }
+#line 461 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
 	YY_BREAK
 case 245:
 YY_RULE_SETUP
-#line 455 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSTAP_VERSION) }
+#line 462 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_IDENTITY) }
 	YY_BREAK
 case 246:
 YY_RULE_SETUP
-#line 456 "./util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
+#line 463 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSTAP_VERSION) }
 	YY_BREAK
 case 247:
 YY_RULE_SETUP
-#line 458 "./util/configlexer.lex"
+#line 464 "./util/configlexer.lex"
 {
-		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
+		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
 	YY_BREAK
 case 248:
 YY_RULE_SETUP
-#line 460 "./util/configlexer.lex"
+#line 466 "./util/configlexer.lex"
 {
-		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
+		YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
 	YY_BREAK
 case 249:
 YY_RULE_SETUP
-#line 462 "./util/configlexer.lex"
+#line 468 "./util/configlexer.lex"
 {
-		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
+		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
 	YY_BREAK
 case 250:
 YY_RULE_SETUP
-#line 464 "./util/configlexer.lex"
+#line 470 "./util/configlexer.lex"
 {
-		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
+		YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
 	YY_BREAK
 case 251:
 YY_RULE_SETUP
-#line 466 "./util/configlexer.lex"
+#line 472 "./util/configlexer.lex"
 {
-		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
+		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
 	YY_BREAK
 case 252:
 YY_RULE_SETUP
-#line 468 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) }
+#line 474 "./util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
 	YY_BREAK
 case 253:
 YY_RULE_SETUP
-#line 469 "./util/configlexer.lex"
-{ YDVAR(1, VAR_IP_RATELIMIT) }
+#line 476 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) }
 	YY_BREAK
 case 254:
 YY_RULE_SETUP
-#line 470 "./util/configlexer.lex"
-{ YDVAR(1, VAR_RATELIMIT) }
+#line 477 "./util/configlexer.lex"
+{ YDVAR(1, VAR_IP_RATELIMIT) }
 	YY_BREAK
 case 255:
 YY_RULE_SETUP
-#line 471 "./util/configlexer.lex"
-{ YDVAR(1, VAR_IP_RATELIMIT_SLABS) }
+#line 478 "./util/configlexer.lex"
+{ YDVAR(1, VAR_RATELIMIT) }
 	YY_BREAK
 case 256:
 YY_RULE_SETUP
-#line 472 "./util/configlexer.lex"
-{ YDVAR(1, VAR_RATELIMIT_SLABS) }
+#line 479 "./util/configlexer.lex"
+{ YDVAR(1, VAR_IP_RATELIMIT_SLABS) }
 	YY_BREAK
 case 257:
 YY_RULE_SETUP
-#line 473 "./util/configlexer.lex"
-{ YDVAR(1, VAR_IP_RATELIMIT_SIZE) }
+#line 480 "./util/configlexer.lex"
+{ YDVAR(1, VAR_RATELIMIT_SLABS) }
 	YY_BREAK
 case 258:
 YY_RULE_SETUP
-#line 474 "./util/configlexer.lex"
-{ YDVAR(1, VAR_RATELIMIT_SIZE) }
+#line 481 "./util/configlexer.lex"
+{ YDVAR(1, VAR_IP_RATELIMIT_SIZE) }
 	YY_BREAK
 case 259:
 YY_RULE_SETUP
-#line 475 "./util/configlexer.lex"
-{ YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) }
+#line 482 "./util/configlexer.lex"
+{ YDVAR(1, VAR_RATELIMIT_SIZE) }
 	YY_BREAK
 case 260:
 YY_RULE_SETUP
-#line 476 "./util/configlexer.lex"
-{ YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) }
+#line 483 "./util/configlexer.lex"
+{ YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) }
 	YY_BREAK
 case 261:
 YY_RULE_SETUP
-#line 477 "./util/configlexer.lex"
-{ YDVAR(1, VAR_IP_RATELIMIT_FACTOR) }
+#line 484 "./util/configlexer.lex"
+{ YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) }
 	YY_BREAK
 case 262:
 YY_RULE_SETUP
-#line 478 "./util/configlexer.lex"
-{ YDVAR(1, VAR_RATELIMIT_FACTOR) }
+#line 485 "./util/configlexer.lex"
+{ YDVAR(1, VAR_IP_RATELIMIT_FACTOR) }
 	YY_BREAK
 case 263:
 YY_RULE_SETUP
-#line 479 "./util/configlexer.lex"
-{ YDVAR(1, VAR_LOW_RTT) }
+#line 486 "./util/configlexer.lex"
+{ YDVAR(1, VAR_RATELIMIT_FACTOR) }
 	YY_BREAK
 case 264:
 YY_RULE_SETUP
-#line 480 "./util/configlexer.lex"
-{ YDVAR(1, VAR_FAST_SERVER_NUM) }
+#line 487 "./util/configlexer.lex"
+{ YDVAR(1, VAR_LOW_RTT) }
 	YY_BREAK
 case 265:
 YY_RULE_SETUP
-#line 481 "./util/configlexer.lex"
-{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
+#line 488 "./util/configlexer.lex"
+{ YDVAR(1, VAR_FAST_SERVER_NUM) }
 	YY_BREAK
 case 266:
 YY_RULE_SETUP
-#line 482 "./util/configlexer.lex"
+#line 489 "./util/configlexer.lex"
 { YDVAR(1, VAR_FAST_SERVER_PERMIL) }
 	YY_BREAK
 case 267:
 YY_RULE_SETUP
-#line 483 "./util/configlexer.lex"
+#line 490 "./util/configlexer.lex"
 { YDVAR(1, VAR_FAST_SERVER_PERMIL) }
 	YY_BREAK
 case 268:
 YY_RULE_SETUP
-#line 484 "./util/configlexer.lex"
-{ YDVAR(2, VAR_RESPONSE_IP_TAG) }
+#line 491 "./util/configlexer.lex"
+{ YDVAR(1, VAR_FAST_SERVER_PERMIL) }
 	YY_BREAK
 case 269:
 YY_RULE_SETUP
-#line 485 "./util/configlexer.lex"
-{ YDVAR(2, VAR_RESPONSE_IP) }
+#line 492 "./util/configlexer.lex"
+{ YDVAR(2, VAR_RESPONSE_IP_TAG) }
 	YY_BREAK
 case 270:
 YY_RULE_SETUP
-#line 486 "./util/configlexer.lex"
-{ YDVAR(2, VAR_RESPONSE_IP_DATA) }
+#line 493 "./util/configlexer.lex"
+{ YDVAR(2, VAR_RESPONSE_IP) }
 	YY_BREAK
 case 271:
 YY_RULE_SETUP
-#line 487 "./util/configlexer.lex"
-{ YDVAR(0, VAR_DNSCRYPT) }
+#line 494 "./util/configlexer.lex"
+{ YDVAR(2, VAR_RESPONSE_IP_DATA) }
 	YY_BREAK
 case 272:
 YY_RULE_SETUP
-#line 488 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_ENABLE) }
+#line 495 "./util/configlexer.lex"
+{ YDVAR(0, VAR_DNSCRYPT) }
 	YY_BREAK
 case 273:
 YY_RULE_SETUP
-#line 489 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_PORT) }
+#line 496 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_ENABLE) }
 	YY_BREAK
 case 274:
 YY_RULE_SETUP
-#line 490 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_PROVIDER) }
+#line 497 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_PORT) }
 	YY_BREAK
 case 275:
 YY_RULE_SETUP
-#line 491 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_SECRET_KEY) }
+#line 498 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_PROVIDER) }
 	YY_BREAK
 case 276:
 YY_RULE_SETUP
-#line 492 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT) }
+#line 499 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_SECRET_KEY) }
 	YY_BREAK
 case 277:
 YY_RULE_SETUP
-#line 493 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT_ROTATED) }
+#line 500 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT) }
 	YY_BREAK
 case 278:
 YY_RULE_SETUP
-#line 494 "./util/configlexer.lex"
-{
-		YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE) }
+#line 501 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT_ROTATED) }
 	YY_BREAK
 case 279:
 YY_RULE_SETUP
-#line 496 "./util/configlexer.lex"
+#line 502 "./util/configlexer.lex"
 {
-		YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) }
+		YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE) }
 	YY_BREAK
 case 280:
 YY_RULE_SETUP
-#line 498 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SIZE) }
+#line 504 "./util/configlexer.lex"
+{
+		YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) }
 	YY_BREAK
 case 281:
 YY_RULE_SETUP
-#line 499 "./util/configlexer.lex"
-{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SLABS) }
+#line 506 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SIZE) }
 	YY_BREAK
 case 282:
 YY_RULE_SETUP
-#line 500 "./util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_ENABLED) }
+#line 507 "./util/configlexer.lex"
+{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SLABS) }
 	YY_BREAK
 case 283:
 YY_RULE_SETUP
-#line 501 "./util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) }
+#line 508 "./util/configlexer.lex"
+{ YDVAR(1, VAR_IPSECMOD_ENABLED) }
 	YY_BREAK
 case 284:
 YY_RULE_SETUP
-#line 502 "./util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_HOOK) }
+#line 509 "./util/configlexer.lex"
+{ YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) }
 	YY_BREAK
 case 285:
 YY_RULE_SETUP
-#line 503 "./util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_MAX_TTL) }
+#line 510 "./util/configlexer.lex"
+{ YDVAR(1, VAR_IPSECMOD_HOOK) }
 	YY_BREAK
 case 286:
 YY_RULE_SETUP
-#line 504 "./util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_WHITELIST) }
+#line 511 "./util/configlexer.lex"
+{ YDVAR(1, VAR_IPSECMOD_MAX_TTL) }
 	YY_BREAK
 case 287:
 YY_RULE_SETUP
-#line 505 "./util/configlexer.lex"
-{ YDVAR(1, VAR_IPSECMOD_STRICT) }
+#line 512 "./util/configlexer.lex"
+{ YDVAR(1, VAR_IPSECMOD_WHITELIST) }
 	YY_BREAK
 case 288:
 YY_RULE_SETUP
-#line 506 "./util/configlexer.lex"
-{ YDVAR(0, VAR_CACHEDB) }
+#line 513 "./util/configlexer.lex"
+{ YDVAR(1, VAR_IPSECMOD_STRICT) }
 	YY_BREAK
 case 289:
 YY_RULE_SETUP
-#line 507 "./util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_BACKEND) }
+#line 514 "./util/configlexer.lex"
+{ YDVAR(0, VAR_CACHEDB) }
 	YY_BREAK
 case 290:
 YY_RULE_SETUP
-#line 508 "./util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_SECRETSEED) }
+#line 515 "./util/configlexer.lex"
+{ YDVAR(1, VAR_CACHEDB_BACKEND) }
 	YY_BREAK
 case 291:
 YY_RULE_SETUP
-#line 509 "./util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_REDISHOST) }
+#line 516 "./util/configlexer.lex"
+{ YDVAR(1, VAR_CACHEDB_SECRETSEED) }
 	YY_BREAK
 case 292:
 YY_RULE_SETUP
-#line 510 "./util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_REDISPORT) }
+#line 517 "./util/configlexer.lex"
+{ YDVAR(1, VAR_CACHEDB_REDISHOST) }
 	YY_BREAK
 case 293:
 YY_RULE_SETUP
-#line 511 "./util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) }
+#line 518 "./util/configlexer.lex"
+{ YDVAR(1, VAR_CACHEDB_REDISPORT) }
 	YY_BREAK
 case 294:
 YY_RULE_SETUP
-#line 512 "./util/configlexer.lex"
-{ YDVAR(1, VAR_CACHEDB_REDISEXPIRERECORDS) }
+#line 519 "./util/configlexer.lex"
+{ YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) }
 	YY_BREAK
 case 295:
 YY_RULE_SETUP
-#line 513 "./util/configlexer.lex"
-{ YDVAR(0, VAR_IPSET) }
+#line 520 "./util/configlexer.lex"
+{ YDVAR(1, VAR_CACHEDB_REDISEXPIRERECORDS) }
 	YY_BREAK
 case 296:
 YY_RULE_SETUP
-#line 514 "./util/configlexer.lex"
-{ YDVAR(1, VAR_IPSET_NAME_V4) }
+#line 521 "./util/configlexer.lex"
+{ YDVAR(0, VAR_IPSET) }
 	YY_BREAK
 case 297:
 YY_RULE_SETUP
-#line 515 "./util/configlexer.lex"
-{ YDVAR(1, VAR_IPSET_NAME_V6) }
+#line 522 "./util/configlexer.lex"
+{ YDVAR(1, VAR_IPSET_NAME_V4) }
 	YY_BREAK
 case 298:
 YY_RULE_SETUP
-#line 516 "./util/configlexer.lex"
-{ YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) }
+#line 523 "./util/configlexer.lex"
+{ YDVAR(1, VAR_IPSET_NAME_V6) }
 	YY_BREAK
 case 299:
 YY_RULE_SETUP
-#line 517 "./util/configlexer.lex"
-{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
+#line 524 "./util/configlexer.lex"
+{ YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) }
 	YY_BREAK
 case 300:
-/* rule 300 can match eol */
 YY_RULE_SETUP
-#line 518 "./util/configlexer.lex"
+#line 525 "./util/configlexer.lex"
+{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
+	YY_BREAK
+case 301:
+YY_RULE_SETUP
+#line 526 "./util/configlexer.lex"
+{ YDVAR(2, VAR_EDNS_CLIENT_TAG) }
+	YY_BREAK
+case 302:
+/* rule 302 can match eol */
+YY_RULE_SETUP
+#line 527 "./util/configlexer.lex"
 { LEXOUT(("NL\n")); cfg_parser->line++; }
 	YY_BREAK
 /* Quoted strings. Strip leading and ending quotes */
-case 301:
+case 303:
 YY_RULE_SETUP
-#line 521 "./util/configlexer.lex"
+#line 530 "./util/configlexer.lex"
 { BEGIN(quotedstring); LEXOUT(("QS ")); }
 	YY_BREAK
 case YY_STATE_EOF(quotedstring):
-#line 522 "./util/configlexer.lex"
+#line 531 "./util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
 	if(--num_args == 0) { BEGIN(INITIAL); }
 	else		    { BEGIN(val); }
 }
 	YY_BREAK
-case 302:
+case 304:
 YY_RULE_SETUP
-#line 527 "./util/configlexer.lex"
+#line 536 "./util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 303:
-/* rule 303 can match eol */
+case 305:
+/* rule 305 can match eol */
 YY_RULE_SETUP
-#line 528 "./util/configlexer.lex"
+#line 537 "./util/configlexer.lex"
 { yyerror("newline inside quoted string, no end \""); 
 			  cfg_parser->line++; BEGIN(INITIAL); }
 	YY_BREAK
-case 304:
+case 306:
 YY_RULE_SETUP
-#line 530 "./util/configlexer.lex"
+#line 539 "./util/configlexer.lex"
 {
         LEXOUT(("QE "));
 	if(--num_args == 0) { BEGIN(INITIAL); }
@@ -4881,34 +4953,34 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 /* Single Quoted strings. Strip leading and ending quotes */
-case 305:
+case 307:
 YY_RULE_SETUP
-#line 542 "./util/configlexer.lex"
+#line 551 "./util/configlexer.lex"
 { BEGIN(singlequotedstr); LEXOUT(("SQS ")); }
 	YY_BREAK
 case YY_STATE_EOF(singlequotedstr):
-#line 543 "./util/configlexer.lex"
+#line 552 "./util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
 	if(--num_args == 0) { BEGIN(INITIAL); }
 	else		    { BEGIN(val); }
 }
 	YY_BREAK
-case 306:
+case 308:
 YY_RULE_SETUP
-#line 548 "./util/configlexer.lex"
+#line 557 "./util/configlexer.lex"
 { LEXOUT(("STR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 307:
-/* rule 307 can match eol */
+case 309:
+/* rule 309 can match eol */
 YY_RULE_SETUP
-#line 549 "./util/configlexer.lex"
+#line 558 "./util/configlexer.lex"
 { yyerror("newline inside quoted string, no end '"); 
 			     cfg_parser->line++; BEGIN(INITIAL); }
 	YY_BREAK
-case 308:
+case 310:
 YY_RULE_SETUP
-#line 551 "./util/configlexer.lex"
+#line 560 "./util/configlexer.lex"
 {
         LEXOUT(("SQE "));
 	if(--num_args == 0) { BEGIN(INITIAL); }
@@ -4921,114 +4993,189 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 /* include: directive */
-case 309:
+case 311:
 YY_RULE_SETUP
-#line 563 "./util/configlexer.lex"
+#line 572 "./util/configlexer.lex"
 { 
 	LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include); }
 	YY_BREAK
 case YY_STATE_EOF(include):
-#line 565 "./util/configlexer.lex"
+#line 574 "./util/configlexer.lex"
 {
         yyerror("EOF inside include directive");
         BEGIN(inc_prev);
 }
 	YY_BREAK
-case 310:
-YY_RULE_SETUP
-#line 569 "./util/configlexer.lex"
-{ LEXOUT(("ISP ")); /* ignore */ }
-	YY_BREAK
-case 311:
-/* rule 311 can match eol */
-YY_RULE_SETUP
-#line 570 "./util/configlexer.lex"
-{ LEXOUT(("NL\n")); cfg_parser->line++;}
-	YY_BREAK
 case 312:
 YY_RULE_SETUP
-#line 571 "./util/configlexer.lex"
-{ LEXOUT(("IQS ")); BEGIN(include_quoted); }
+#line 578 "./util/configlexer.lex"
+{ LEXOUT(("ISP ")); /* ignore */ }
 	YY_BREAK
 case 313:
+/* rule 313 can match eol */
 YY_RULE_SETUP
-#line 572 "./util/configlexer.lex"
+#line 579 "./util/configlexer.lex"
+{ LEXOUT(("NL\n")); cfg_parser->line++;}
+	YY_BREAK
+case 314:
+YY_RULE_SETUP
+#line 580 "./util/configlexer.lex"
+{ LEXOUT(("IQS ")); BEGIN(include_quoted); }
+	YY_BREAK
+case 315:
+YY_RULE_SETUP
+#line 581 "./util/configlexer.lex"
 {
 	LEXOUT(("Iunquotedstr(%s) ", yytext));
-	config_start_include_glob(yytext);
+	config_start_include_glob(yytext, 0);
 	BEGIN(inc_prev);
 }
 	YY_BREAK
 case YY_STATE_EOF(include_quoted):
-#line 577 "./util/configlexer.lex"
+#line 586 "./util/configlexer.lex"
 {
         yyerror("EOF inside quoted string");
         BEGIN(inc_prev);
 }
 	YY_BREAK
-case 314:
+case 316:
 YY_RULE_SETUP
-#line 581 "./util/configlexer.lex"
+#line 590 "./util/configlexer.lex"
 { LEXOUT(("ISTR(%s) ", yytext)); yymore(); }
 	YY_BREAK
-case 315:
-/* rule 315 can match eol */
+case 317:
+/* rule 317 can match eol */
 YY_RULE_SETUP
-#line 582 "./util/configlexer.lex"
+#line 591 "./util/configlexer.lex"
 { yyerror("newline before \" in include name"); 
 				  cfg_parser->line++; BEGIN(inc_prev); }
 	YY_BREAK
-case 316:
+case 318:
 YY_RULE_SETUP
-#line 584 "./util/configlexer.lex"
+#line 593 "./util/configlexer.lex"
 {
 	LEXOUT(("IQE "));
 	yytext[yyleng - 1] = '\0';
-	config_start_include_glob(yytext);
+	config_start_include_glob(yytext, 0);
 	BEGIN(inc_prev);
 }
 	YY_BREAK
 case YY_STATE_EOF(INITIAL):
 case YY_STATE_EOF(val):
-#line 590 "./util/configlexer.lex"
+#line 599 "./util/configlexer.lex"
 {
 	LEXOUT(("LEXEOF "));
 	yy_set_bol(1); /* Set beginning of line, so "^" rules match.  */
 	if (!config_include_stack) {
 		yyterminate();
 	} else {
+		int prev_toplevel = inc_toplevel;
 		fclose(yyin);
 		config_end_include();
+		if(prev_toplevel) return (VAR_FORCE_TOPLEVEL);
 	}
 }
 	YY_BREAK
-case 317:
+/* include-toplevel: directive */
+case 319:
 YY_RULE_SETUP
-#line 601 "./util/configlexer.lex"
+#line 613 "./util/configlexer.lex"
+{
+	LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include_toplevel);
+}
+	YY_BREAK
+case YY_STATE_EOF(include_toplevel):
+#line 616 "./util/configlexer.lex"
+{
+	yyerror("EOF inside include_toplevel directive");
+	BEGIN(inc_prev);
+}
+	YY_BREAK
+case 320:
+YY_RULE_SETUP
+#line 620 "./util/configlexer.lex"
+{ LEXOUT(("ITSP ")); /* ignore */ }
+	YY_BREAK
+case 321:
+/* rule 321 can match eol */
+YY_RULE_SETUP
+#line 621 "./util/configlexer.lex"
+{ LEXOUT(("NL\n")); cfg_parser->line++; }
+	YY_BREAK
+case 322:
+YY_RULE_SETUP
+#line 622 "./util/configlexer.lex"
+{ LEXOUT(("ITQS ")); BEGIN(include_toplevel_quoted); }
+	YY_BREAK
+case 323:
+YY_RULE_SETUP
+#line 623 "./util/configlexer.lex"
+{
+	LEXOUT(("ITunquotedstr(%s) ", yytext));
+	config_start_include_glob(yytext, 1);
+	BEGIN(inc_prev);
+	return (VAR_FORCE_TOPLEVEL);
+}
+	YY_BREAK
+case YY_STATE_EOF(include_toplevel_quoted):
+#line 629 "./util/configlexer.lex"
+{
+	yyerror("EOF inside quoted string");
+	BEGIN(inc_prev);
+}
+	YY_BREAK
+case 324:
+YY_RULE_SETUP
+#line 633 "./util/configlexer.lex"
+{ LEXOUT(("ITSTR(%s) ", yytext)); yymore(); }
+	YY_BREAK
+case 325:
+/* rule 325 can match eol */
+YY_RULE_SETUP
+#line 634 "./util/configlexer.lex"
+{
+	yyerror("newline before \" in include name");
+	cfg_parser->line++; BEGIN(inc_prev);
+}
+	YY_BREAK
+case 326:
+YY_RULE_SETUP
+#line 638 "./util/configlexer.lex"
+{
+	LEXOUT(("ITQE "));
+	yytext[yyleng - 1] = '\0';
+	config_start_include_glob(yytext, 1);
+	BEGIN(inc_prev);
+	return (VAR_FORCE_TOPLEVEL);
+}
+	YY_BREAK
+case 327:
+YY_RULE_SETUP
+#line 646 "./util/configlexer.lex"
 { LEXOUT(("unquotedstr(%s) ", yytext)); 
 			if(--num_args == 0) { BEGIN(INITIAL); }
 			yylval.str = strdup(yytext); return STRING_ARG; }
 	YY_BREAK
-case 318:
+case 328:
 YY_RULE_SETUP
-#line 605 "./util/configlexer.lex"
+#line 650 "./util/configlexer.lex"
 {
 	ub_c_error_msg("unknown keyword '%s'", yytext);
 	}
 	YY_BREAK
-case 319:
+case 329:
 YY_RULE_SETUP
-#line 609 "./util/configlexer.lex"
+#line 654 "./util/configlexer.lex"
 {
 	ub_c_error_msg("stray '%s'", yytext);
 	}
 	YY_BREAK
-case 320:
+case 330:
 YY_RULE_SETUP
-#line 613 "./util/configlexer.lex"
+#line 658 "./util/configlexer.lex"
 ECHO;
 	YY_BREAK
-#line 5030 "<stdout>"
+#line 5177 "<stdout>"
 
 	case YY_END_OF_BUFFER:
 		{
@@ -5323,7 +5470,7 @@ static int yy_get_next_buffer (void)
 		while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 			{
 			yy_current_state = (int) yy_def[yy_current_state];
-			if ( yy_current_state >= 3162 )
+			if ( yy_current_state >= 3227 )
 				yy_c = yy_meta[yy_c];
 			}
 		yy_current_state = yy_nxt[yy_base[yy_current_state] + yy_c];
@@ -5351,11 +5498,11 @@ static int yy_get_next_buffer (void)
 	while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
 		{
 		yy_current_state = (int) yy_def[yy_current_state];
-		if ( yy_current_state >= 3162 )
+		if ( yy_current_state >= 3227 )
 			yy_c = yy_meta[yy_c];
 		}
 	yy_current_state = yy_nxt[yy_base[yy_current_state] + yy_c];
-	yy_is_jam = (yy_current_state == 3161);
+	yy_is_jam = (yy_current_state == 3226);
 
 		return yy_is_jam ? 0 : yy_current_state;
 }
@@ -5994,6 +6141,6 @@ void yyfree (void * ptr )
 
 #define YYTABLES_NAME "yytables"
 
-#line 613 "./util/configlexer.lex"
+#line 658 "./util/configlexer.lex"
 
 
diff --git a/util/configlexer.lex b/util/configlexer.lex
index 414d673d5..a9b73d989 100644
--- a/util/configlexer.lex
+++ b/util/configlexer.lex
@@ -45,11 +45,13 @@ struct inc_state {
 	int line;
 	YY_BUFFER_STATE buffer;
 	struct inc_state* next;
+	int inc_toplevel;
 };
 static struct inc_state* config_include_stack = NULL;
 static int inc_depth = 0;
 static int inc_prev = 0;
 static int num_args = 0;
+static int inc_toplevel = 0;
 
 void init_cfg_parse(void)
 {
@@ -57,14 +59,15 @@ void init_cfg_parse(void)
 	inc_depth = 0;
 	inc_prev = 0;
 	num_args = 0;
+	inc_toplevel = 0;
 }
 
-static void config_start_include(const char* filename)
+static void config_start_include(const char* filename, int toplevel)
 {
 	FILE *input;
 	struct inc_state* s;
 	char* nm;
-	if(inc_depth++ > 100000) {
+	if(inc_depth+1 > 100000) {
 		ub_c_error_msg("too many include files");
 		return;
 	}
@@ -96,17 +99,20 @@ static void config_start_include(const char* filename)
 		return;
 	}
 	LEXOUT(("switch_to_include_file(%s)\n", filename));
+	inc_depth++;
 	s->filename = cfg_parser->filename;
 	s->line = cfg_parser->line;
 	s->buffer = YY_CURRENT_BUFFER;
+	s->inc_toplevel = inc_toplevel;
 	s->next = config_include_stack;
 	config_include_stack = s;
 	cfg_parser->filename = nm;
 	cfg_parser->line = 1;
+	inc_toplevel = toplevel;
 	yy_switch_to_buffer(yy_create_buffer(input, YY_BUF_SIZE));
 }
 
-static void config_start_include_glob(const char* filename)
+static void config_start_include_glob(const char* filename, int toplevel)
 {
 
 	/* check for wildcards */
@@ -139,19 +145,19 @@ static void config_start_include_glob(const char* filename)
 			globfree(&g);
 			if(r == GLOB_NOMATCH)
 				return; /* no matches for pattern */
-			config_start_include(filename); /* let original deal with it */
+			config_start_include(filename, toplevel); /* let original deal with it */
 			return;
 		}
 		/* process files found, if any */
 		for(i=(int)g.gl_pathc-1; i>=0; i--) {
-			config_start_include(g.gl_pathv[i]);
+			config_start_include(g.gl_pathv[i], toplevel);
 		}
 		globfree(&g);
 		return;
 	}
 #endif /* HAVE_GLOB */
 
-	config_start_include(filename);
+	config_start_include(filename, toplevel);
 }
 
 static void config_end_include(void)
@@ -165,6 +171,7 @@ static void config_end_include(void)
 	yy_delete_buffer(YY_CURRENT_BUFFER);
 	yy_switch_to_buffer(s->buffer);
 	config_include_stack = s->next;
+	inc_toplevel = s->inc_toplevel;
 	free(s);
 }
 
@@ -199,7 +206,7 @@ COLON 	\:
 DQANY     [^\"\n\r\\]|\\.
 SQANY     [^\'\n\r\\]|\\.
 
-%x	quotedstring singlequotedstr include include_quoted val
+%x	quotedstring singlequotedstr include include_quoted val include_toplevel include_toplevel_quoted
 
 %%
 <INITIAL,val>{SPACE}*	{ 
@@ -440,6 +447,7 @@ access-control-view{COLON}	{ YDVAR(2, VAR_ACCESS_CONTROL_VIEW) }
 local-zone-override{COLON}	{ YDVAR(3, VAR_LOCAL_ZONE_OVERRIDE) }
 dnstap{COLON}			{ YDVAR(0, VAR_DNSTAP) }
 dnstap-enable{COLON}		{ YDVAR(1, VAR_DNSTAP_ENABLE) }
+dnstap-bidirectional{COLON}	{ YDVAR(1, VAR_DNSTAP_BIDIRECTIONAL) }
 dnstap-socket-path{COLON}	{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
 dnstap-ip{COLON}		{ YDVAR(1, VAR_DNSTAP_IP) }
 dnstap-tls{COLON}		{ YDVAR(1, VAR_DNSTAP_TLS) }
@@ -515,6 +523,7 @@ name-v4{COLON}			{ YDVAR(1, VAR_IPSET_NAME_V4) }
 name-v6{COLON}			{ YDVAR(1, VAR_IPSET_NAME_V6) }
 udp-upstream-without-downstream{COLON} { YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) }
 tcp-connection-limit{COLON}	{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
+edns-client-tag{COLON}		{ YDVAR(2, VAR_EDNS_CLIENT_TAG) }
 <INITIAL,val>{NEWLINE}		{ LEXOUT(("NL\n")); cfg_parser->line++; }
 
 	/* Quoted strings. Strip leading and ending quotes */
@@ -571,7 +580,7 @@ tcp-connection-limit{COLON}	{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
 <include>\"		{ LEXOUT(("IQS ")); BEGIN(include_quoted); }
 <include>{UNQUOTEDLETTER}*	{
 	LEXOUT(("Iunquotedstr(%s) ", yytext));
-	config_start_include_glob(yytext);
+	config_start_include_glob(yytext, 0);
 	BEGIN(inc_prev);
 }
 <include_quoted><<EOF>>	{
@@ -584,7 +593,7 @@ tcp-connection-limit{COLON}	{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
 <include_quoted>\"	{
 	LEXOUT(("IQE "));
 	yytext[yyleng - 1] = '\0';
-	config_start_include_glob(yytext);
+	config_start_include_glob(yytext, 0);
 	BEGIN(inc_prev);
 }
 <INITIAL,val><<EOF>>	{
@@ -593,11 +602,47 @@ tcp-connection-limit{COLON}	{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
 	if (!config_include_stack) {
 		yyterminate();
 	} else {
+		int prev_toplevel = inc_toplevel;
 		fclose(yyin);
 		config_end_include();
+		if(prev_toplevel) return (VAR_FORCE_TOPLEVEL);
 	}
 }
 
+	/* include-toplevel: directive */
+<INITIAL,val>include-toplevel{COLON} {
+	LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include_toplevel);
+}
+<include_toplevel><<EOF>> {
+	yyerror("EOF inside include_toplevel directive");
+	BEGIN(inc_prev);
+}
+<include_toplevel>{SPACE}* { LEXOUT(("ITSP ")); /* ignore */ }
+<include_toplevel>{NEWLINE} { LEXOUT(("NL\n")); cfg_parser->line++; }
+<include_toplevel>\" { LEXOUT(("ITQS ")); BEGIN(include_toplevel_quoted); }
+<include_toplevel>{UNQUOTEDLETTER}* {
+	LEXOUT(("ITunquotedstr(%s) ", yytext));
+	config_start_include_glob(yytext, 1);
+	BEGIN(inc_prev);
+	return (VAR_FORCE_TOPLEVEL);
+}
+<include_toplevel_quoted><<EOF>> {
+	yyerror("EOF inside quoted string");
+	BEGIN(inc_prev);
+}
+<include_toplevel_quoted>{DQANY}* { LEXOUT(("ITSTR(%s) ", yytext)); yymore(); }
+<include_toplevel_quoted>{NEWLINE} {
+	yyerror("newline before \" in include name");
+	cfg_parser->line++; BEGIN(inc_prev);
+}
+<include_toplevel_quoted>\" {
+	LEXOUT(("ITQE "));
+	yytext[yyleng - 1] = '\0';
+	config_start_include_glob(yytext, 1);
+	BEGIN(inc_prev);
+	return (VAR_FORCE_TOPLEVEL);
+}
+
 <val>{UNQUOTEDLETTER}*	{ LEXOUT(("unquotedstr(%s) ", yytext)); 
 			if(--num_args == 0) { BEGIN(INITIAL); }
 			yylval.str = strdup(yytext); return STRING_ARG; }
diff --git a/util/configparser.c b/util/configparser.c
index c763738c5..7e7c3fc3f 100644
--- a/util/configparser.c
+++ b/util/configparser.c
@@ -151,291 +151,294 @@ extern int yydebug;
     ANY = 263,
     ZONESTR = 264,
     STRING_ARG = 265,
-    VAR_SERVER = 266,
-    VAR_VERBOSITY = 267,
-    VAR_NUM_THREADS = 268,
-    VAR_PORT = 269,
-    VAR_OUTGOING_RANGE = 270,
-    VAR_INTERFACE = 271,
-    VAR_PREFER_IP4 = 272,
-    VAR_DO_IP4 = 273,
-    VAR_DO_IP6 = 274,
-    VAR_PREFER_IP6 = 275,
-    VAR_DO_UDP = 276,
-    VAR_DO_TCP = 277,
-    VAR_TCP_MSS = 278,
-    VAR_OUTGOING_TCP_MSS = 279,
-    VAR_TCP_IDLE_TIMEOUT = 280,
-    VAR_EDNS_TCP_KEEPALIVE = 281,
-    VAR_EDNS_TCP_KEEPALIVE_TIMEOUT = 282,
-    VAR_CHROOT = 283,
-    VAR_USERNAME = 284,
-    VAR_DIRECTORY = 285,
-    VAR_LOGFILE = 286,
-    VAR_PIDFILE = 287,
-    VAR_MSG_CACHE_SIZE = 288,
-    VAR_MSG_CACHE_SLABS = 289,
-    VAR_NUM_QUERIES_PER_THREAD = 290,
-    VAR_RRSET_CACHE_SIZE = 291,
-    VAR_RRSET_CACHE_SLABS = 292,
-    VAR_OUTGOING_NUM_TCP = 293,
-    VAR_INFRA_HOST_TTL = 294,
-    VAR_INFRA_LAME_TTL = 295,
-    VAR_INFRA_CACHE_SLABS = 296,
-    VAR_INFRA_CACHE_NUMHOSTS = 297,
-    VAR_INFRA_CACHE_LAME_SIZE = 298,
-    VAR_NAME = 299,
-    VAR_STUB_ZONE = 300,
-    VAR_STUB_HOST = 301,
-    VAR_STUB_ADDR = 302,
-    VAR_TARGET_FETCH_POLICY = 303,
-    VAR_HARDEN_SHORT_BUFSIZE = 304,
-    VAR_HARDEN_LARGE_QUERIES = 305,
-    VAR_FORWARD_ZONE = 306,
-    VAR_FORWARD_HOST = 307,
-    VAR_FORWARD_ADDR = 308,
-    VAR_DO_NOT_QUERY_ADDRESS = 309,
-    VAR_HIDE_IDENTITY = 310,
-    VAR_HIDE_VERSION = 311,
-    VAR_IDENTITY = 312,
-    VAR_VERSION = 313,
-    VAR_HARDEN_GLUE = 314,
-    VAR_MODULE_CONF = 315,
-    VAR_TRUST_ANCHOR_FILE = 316,
-    VAR_TRUST_ANCHOR = 317,
-    VAR_VAL_OVERRIDE_DATE = 318,
-    VAR_BOGUS_TTL = 319,
-    VAR_VAL_CLEAN_ADDITIONAL = 320,
-    VAR_VAL_PERMISSIVE_MODE = 321,
-    VAR_INCOMING_NUM_TCP = 322,
-    VAR_MSG_BUFFER_SIZE = 323,
-    VAR_KEY_CACHE_SIZE = 324,
-    VAR_KEY_CACHE_SLABS = 325,
-    VAR_TRUSTED_KEYS_FILE = 326,
-    VAR_VAL_NSEC3_KEYSIZE_ITERATIONS = 327,
-    VAR_USE_SYSLOG = 328,
-    VAR_OUTGOING_INTERFACE = 329,
-    VAR_ROOT_HINTS = 330,
-    VAR_DO_NOT_QUERY_LOCALHOST = 331,
-    VAR_CACHE_MAX_TTL = 332,
-    VAR_HARDEN_DNSSEC_STRIPPED = 333,
-    VAR_ACCESS_CONTROL = 334,
-    VAR_LOCAL_ZONE = 335,
-    VAR_LOCAL_DATA = 336,
-    VAR_INTERFACE_AUTOMATIC = 337,
-    VAR_STATISTICS_INTERVAL = 338,
-    VAR_DO_DAEMONIZE = 339,
-    VAR_USE_CAPS_FOR_ID = 340,
-    VAR_STATISTICS_CUMULATIVE = 341,
-    VAR_OUTGOING_PORT_PERMIT = 342,
-    VAR_OUTGOING_PORT_AVOID = 343,
-    VAR_DLV_ANCHOR_FILE = 344,
-    VAR_DLV_ANCHOR = 345,
-    VAR_NEG_CACHE_SIZE = 346,
-    VAR_HARDEN_REFERRAL_PATH = 347,
-    VAR_PRIVATE_ADDRESS = 348,
-    VAR_PRIVATE_DOMAIN = 349,
-    VAR_REMOTE_CONTROL = 350,
-    VAR_CONTROL_ENABLE = 351,
-    VAR_CONTROL_INTERFACE = 352,
-    VAR_CONTROL_PORT = 353,
-    VAR_SERVER_KEY_FILE = 354,
-    VAR_SERVER_CERT_FILE = 355,
-    VAR_CONTROL_KEY_FILE = 356,
-    VAR_CONTROL_CERT_FILE = 357,
-    VAR_CONTROL_USE_CERT = 358,
-    VAR_EXTENDED_STATISTICS = 359,
-    VAR_LOCAL_DATA_PTR = 360,
-    VAR_JOSTLE_TIMEOUT = 361,
-    VAR_STUB_PRIME = 362,
-    VAR_UNWANTED_REPLY_THRESHOLD = 363,
-    VAR_LOG_TIME_ASCII = 364,
-    VAR_DOMAIN_INSECURE = 365,
-    VAR_PYTHON = 366,
-    VAR_PYTHON_SCRIPT = 367,
-    VAR_VAL_SIG_SKEW_MIN = 368,
-    VAR_VAL_SIG_SKEW_MAX = 369,
-    VAR_CACHE_MIN_TTL = 370,
-    VAR_VAL_LOG_LEVEL = 371,
-    VAR_AUTO_TRUST_ANCHOR_FILE = 372,
-    VAR_KEEP_MISSING = 373,
-    VAR_ADD_HOLDDOWN = 374,
-    VAR_DEL_HOLDDOWN = 375,
-    VAR_SO_RCVBUF = 376,
-    VAR_EDNS_BUFFER_SIZE = 377,
-    VAR_PREFETCH = 378,
-    VAR_PREFETCH_KEY = 379,
-    VAR_SO_SNDBUF = 380,
-    VAR_SO_REUSEPORT = 381,
-    VAR_HARDEN_BELOW_NXDOMAIN = 382,
-    VAR_IGNORE_CD_FLAG = 383,
-    VAR_LOG_QUERIES = 384,
-    VAR_LOG_REPLIES = 385,
-    VAR_LOG_LOCAL_ACTIONS = 386,
-    VAR_TCP_UPSTREAM = 387,
-    VAR_SSL_UPSTREAM = 388,
-    VAR_SSL_SERVICE_KEY = 389,
-    VAR_SSL_SERVICE_PEM = 390,
-    VAR_SSL_PORT = 391,
-    VAR_FORWARD_FIRST = 392,
-    VAR_STUB_SSL_UPSTREAM = 393,
-    VAR_FORWARD_SSL_UPSTREAM = 394,
-    VAR_TLS_CERT_BUNDLE = 395,
-    VAR_HTTPS_PORT = 396,
-    VAR_HTTP_ENDPOINT = 397,
-    VAR_HTTP_MAX_STREAMS = 398,
-    VAR_HTTP_QUERY_BUFFER_SIZE = 399,
-    VAR_HTTP_RESPONSE_BUFFER_SIZE = 400,
-    VAR_HTTP_NODELAY = 401,
-    VAR_STUB_FIRST = 402,
-    VAR_MINIMAL_RESPONSES = 403,
-    VAR_RRSET_ROUNDROBIN = 404,
-    VAR_MAX_UDP_SIZE = 405,
-    VAR_DELAY_CLOSE = 406,
-    VAR_UNBLOCK_LAN_ZONES = 407,
-    VAR_INSECURE_LAN_ZONES = 408,
-    VAR_INFRA_CACHE_MIN_RTT = 409,
-    VAR_DNS64_PREFIX = 410,
-    VAR_DNS64_SYNTHALL = 411,
-    VAR_DNS64_IGNORE_AAAA = 412,
-    VAR_DNSTAP = 413,
-    VAR_DNSTAP_ENABLE = 414,
-    VAR_DNSTAP_SOCKET_PATH = 415,
-    VAR_DNSTAP_IP = 416,
-    VAR_DNSTAP_TLS = 417,
-    VAR_DNSTAP_TLS_SERVER_NAME = 418,
-    VAR_DNSTAP_TLS_CERT_BUNDLE = 419,
-    VAR_DNSTAP_TLS_CLIENT_KEY_FILE = 420,
-    VAR_DNSTAP_TLS_CLIENT_CERT_FILE = 421,
-    VAR_DNSTAP_SEND_IDENTITY = 422,
-    VAR_DNSTAP_SEND_VERSION = 423,
-    VAR_DNSTAP_IDENTITY = 424,
-    VAR_DNSTAP_VERSION = 425,
-    VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 426,
-    VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 427,
-    VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 428,
-    VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 429,
-    VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 430,
-    VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 431,
-    VAR_RESPONSE_IP_TAG = 432,
-    VAR_RESPONSE_IP = 433,
-    VAR_RESPONSE_IP_DATA = 434,
-    VAR_HARDEN_ALGO_DOWNGRADE = 435,
-    VAR_IP_TRANSPARENT = 436,
-    VAR_IP_DSCP = 437,
-    VAR_DISABLE_DNSSEC_LAME_CHECK = 438,
-    VAR_IP_RATELIMIT = 439,
-    VAR_IP_RATELIMIT_SLABS = 440,
-    VAR_IP_RATELIMIT_SIZE = 441,
-    VAR_RATELIMIT = 442,
-    VAR_RATELIMIT_SLABS = 443,
-    VAR_RATELIMIT_SIZE = 444,
-    VAR_RATELIMIT_FOR_DOMAIN = 445,
-    VAR_RATELIMIT_BELOW_DOMAIN = 446,
-    VAR_IP_RATELIMIT_FACTOR = 447,
-    VAR_RATELIMIT_FACTOR = 448,
-    VAR_SEND_CLIENT_SUBNET = 449,
-    VAR_CLIENT_SUBNET_ZONE = 450,
-    VAR_CLIENT_SUBNET_ALWAYS_FORWARD = 451,
-    VAR_CLIENT_SUBNET_OPCODE = 452,
-    VAR_MAX_CLIENT_SUBNET_IPV4 = 453,
-    VAR_MAX_CLIENT_SUBNET_IPV6 = 454,
-    VAR_MIN_CLIENT_SUBNET_IPV4 = 455,
-    VAR_MIN_CLIENT_SUBNET_IPV6 = 456,
-    VAR_MAX_ECS_TREE_SIZE_IPV4 = 457,
-    VAR_MAX_ECS_TREE_SIZE_IPV6 = 458,
-    VAR_CAPS_WHITELIST = 459,
-    VAR_CACHE_MAX_NEGATIVE_TTL = 460,
-    VAR_PERMIT_SMALL_HOLDDOWN = 461,
-    VAR_QNAME_MINIMISATION = 462,
-    VAR_QNAME_MINIMISATION_STRICT = 463,
-    VAR_IP_FREEBIND = 464,
-    VAR_DEFINE_TAG = 465,
-    VAR_LOCAL_ZONE_TAG = 466,
-    VAR_ACCESS_CONTROL_TAG = 467,
-    VAR_LOCAL_ZONE_OVERRIDE = 468,
-    VAR_ACCESS_CONTROL_TAG_ACTION = 469,
-    VAR_ACCESS_CONTROL_TAG_DATA = 470,
-    VAR_VIEW = 471,
-    VAR_ACCESS_CONTROL_VIEW = 472,
-    VAR_VIEW_FIRST = 473,
-    VAR_SERVE_EXPIRED = 474,
-    VAR_SERVE_EXPIRED_TTL = 475,
-    VAR_SERVE_EXPIRED_TTL_RESET = 476,
-    VAR_SERVE_EXPIRED_REPLY_TTL = 477,
-    VAR_SERVE_EXPIRED_CLIENT_TIMEOUT = 478,
-    VAR_FAKE_DSA = 479,
-    VAR_FAKE_SHA1 = 480,
-    VAR_LOG_IDENTITY = 481,
-    VAR_HIDE_TRUSTANCHOR = 482,
-    VAR_TRUST_ANCHOR_SIGNALING = 483,
-    VAR_AGGRESSIVE_NSEC = 484,
-    VAR_USE_SYSTEMD = 485,
-    VAR_SHM_ENABLE = 486,
-    VAR_SHM_KEY = 487,
-    VAR_ROOT_KEY_SENTINEL = 488,
-    VAR_DNSCRYPT = 489,
-    VAR_DNSCRYPT_ENABLE = 490,
-    VAR_DNSCRYPT_PORT = 491,
-    VAR_DNSCRYPT_PROVIDER = 492,
-    VAR_DNSCRYPT_SECRET_KEY = 493,
-    VAR_DNSCRYPT_PROVIDER_CERT = 494,
-    VAR_DNSCRYPT_PROVIDER_CERT_ROTATED = 495,
-    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 496,
-    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 497,
-    VAR_DNSCRYPT_NONCE_CACHE_SIZE = 498,
-    VAR_DNSCRYPT_NONCE_CACHE_SLABS = 499,
-    VAR_IPSECMOD_ENABLED = 500,
-    VAR_IPSECMOD_HOOK = 501,
-    VAR_IPSECMOD_IGNORE_BOGUS = 502,
-    VAR_IPSECMOD_MAX_TTL = 503,
-    VAR_IPSECMOD_WHITELIST = 504,
-    VAR_IPSECMOD_STRICT = 505,
-    VAR_CACHEDB = 506,
-    VAR_CACHEDB_BACKEND = 507,
-    VAR_CACHEDB_SECRETSEED = 508,
-    VAR_CACHEDB_REDISHOST = 509,
-    VAR_CACHEDB_REDISPORT = 510,
-    VAR_CACHEDB_REDISTIMEOUT = 511,
-    VAR_CACHEDB_REDISEXPIRERECORDS = 512,
-    VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM = 513,
-    VAR_FOR_UPSTREAM = 514,
-    VAR_AUTH_ZONE = 515,
-    VAR_ZONEFILE = 516,
-    VAR_MASTER = 517,
-    VAR_URL = 518,
-    VAR_FOR_DOWNSTREAM = 519,
-    VAR_FALLBACK_ENABLED = 520,
-    VAR_TLS_ADDITIONAL_PORT = 521,
-    VAR_LOW_RTT = 522,
-    VAR_LOW_RTT_PERMIL = 523,
-    VAR_FAST_SERVER_PERMIL = 524,
-    VAR_FAST_SERVER_NUM = 525,
-    VAR_ALLOW_NOTIFY = 526,
-    VAR_TLS_WIN_CERT = 527,
-    VAR_TCP_CONNECTION_LIMIT = 528,
-    VAR_FORWARD_NO_CACHE = 529,
-    VAR_STUB_NO_CACHE = 530,
-    VAR_LOG_SERVFAIL = 531,
-    VAR_DENY_ANY = 532,
-    VAR_UNKNOWN_SERVER_TIME_LIMIT = 533,
-    VAR_LOG_TAG_QUERYREPLY = 534,
-    VAR_STREAM_WAIT_SIZE = 535,
-    VAR_TLS_CIPHERS = 536,
-    VAR_TLS_CIPHERSUITES = 537,
-    VAR_TLS_USE_SNI = 538,
-    VAR_IPSET = 539,
-    VAR_IPSET_NAME_V4 = 540,
-    VAR_IPSET_NAME_V6 = 541,
-    VAR_TLS_SESSION_TICKET_KEYS = 542,
-    VAR_RPZ = 543,
-    VAR_TAGS = 544,
-    VAR_RPZ_ACTION_OVERRIDE = 545,
-    VAR_RPZ_CNAME_OVERRIDE = 546,
-    VAR_RPZ_LOG = 547,
-    VAR_RPZ_LOG_NAME = 548,
-    VAR_DYNLIB = 549,
-    VAR_DYNLIB_FILE = 550
+    VAR_FORCE_TOPLEVEL = 266,
+    VAR_SERVER = 267,
+    VAR_VERBOSITY = 268,
+    VAR_NUM_THREADS = 269,
+    VAR_PORT = 270,
+    VAR_OUTGOING_RANGE = 271,
+    VAR_INTERFACE = 272,
+    VAR_PREFER_IP4 = 273,
+    VAR_DO_IP4 = 274,
+    VAR_DO_IP6 = 275,
+    VAR_PREFER_IP6 = 276,
+    VAR_DO_UDP = 277,
+    VAR_DO_TCP = 278,
+    VAR_TCP_MSS = 279,
+    VAR_OUTGOING_TCP_MSS = 280,
+    VAR_TCP_IDLE_TIMEOUT = 281,
+    VAR_EDNS_TCP_KEEPALIVE = 282,
+    VAR_EDNS_TCP_KEEPALIVE_TIMEOUT = 283,
+    VAR_CHROOT = 284,
+    VAR_USERNAME = 285,
+    VAR_DIRECTORY = 286,
+    VAR_LOGFILE = 287,
+    VAR_PIDFILE = 288,
+    VAR_MSG_CACHE_SIZE = 289,
+    VAR_MSG_CACHE_SLABS = 290,
+    VAR_NUM_QUERIES_PER_THREAD = 291,
+    VAR_RRSET_CACHE_SIZE = 292,
+    VAR_RRSET_CACHE_SLABS = 293,
+    VAR_OUTGOING_NUM_TCP = 294,
+    VAR_INFRA_HOST_TTL = 295,
+    VAR_INFRA_LAME_TTL = 296,
+    VAR_INFRA_CACHE_SLABS = 297,
+    VAR_INFRA_CACHE_NUMHOSTS = 298,
+    VAR_INFRA_CACHE_LAME_SIZE = 299,
+    VAR_NAME = 300,
+    VAR_STUB_ZONE = 301,
+    VAR_STUB_HOST = 302,
+    VAR_STUB_ADDR = 303,
+    VAR_TARGET_FETCH_POLICY = 304,
+    VAR_HARDEN_SHORT_BUFSIZE = 305,
+    VAR_HARDEN_LARGE_QUERIES = 306,
+    VAR_FORWARD_ZONE = 307,
+    VAR_FORWARD_HOST = 308,
+    VAR_FORWARD_ADDR = 309,
+    VAR_DO_NOT_QUERY_ADDRESS = 310,
+    VAR_HIDE_IDENTITY = 311,
+    VAR_HIDE_VERSION = 312,
+    VAR_IDENTITY = 313,
+    VAR_VERSION = 314,
+    VAR_HARDEN_GLUE = 315,
+    VAR_MODULE_CONF = 316,
+    VAR_TRUST_ANCHOR_FILE = 317,
+    VAR_TRUST_ANCHOR = 318,
+    VAR_VAL_OVERRIDE_DATE = 319,
+    VAR_BOGUS_TTL = 320,
+    VAR_VAL_CLEAN_ADDITIONAL = 321,
+    VAR_VAL_PERMISSIVE_MODE = 322,
+    VAR_INCOMING_NUM_TCP = 323,
+    VAR_MSG_BUFFER_SIZE = 324,
+    VAR_KEY_CACHE_SIZE = 325,
+    VAR_KEY_CACHE_SLABS = 326,
+    VAR_TRUSTED_KEYS_FILE = 327,
+    VAR_VAL_NSEC3_KEYSIZE_ITERATIONS = 328,
+    VAR_USE_SYSLOG = 329,
+    VAR_OUTGOING_INTERFACE = 330,
+    VAR_ROOT_HINTS = 331,
+    VAR_DO_NOT_QUERY_LOCALHOST = 332,
+    VAR_CACHE_MAX_TTL = 333,
+    VAR_HARDEN_DNSSEC_STRIPPED = 334,
+    VAR_ACCESS_CONTROL = 335,
+    VAR_LOCAL_ZONE = 336,
+    VAR_LOCAL_DATA = 337,
+    VAR_INTERFACE_AUTOMATIC = 338,
+    VAR_STATISTICS_INTERVAL = 339,
+    VAR_DO_DAEMONIZE = 340,
+    VAR_USE_CAPS_FOR_ID = 341,
+    VAR_STATISTICS_CUMULATIVE = 342,
+    VAR_OUTGOING_PORT_PERMIT = 343,
+    VAR_OUTGOING_PORT_AVOID = 344,
+    VAR_DLV_ANCHOR_FILE = 345,
+    VAR_DLV_ANCHOR = 346,
+    VAR_NEG_CACHE_SIZE = 347,
+    VAR_HARDEN_REFERRAL_PATH = 348,
+    VAR_PRIVATE_ADDRESS = 349,
+    VAR_PRIVATE_DOMAIN = 350,
+    VAR_REMOTE_CONTROL = 351,
+    VAR_CONTROL_ENABLE = 352,
+    VAR_CONTROL_INTERFACE = 353,
+    VAR_CONTROL_PORT = 354,
+    VAR_SERVER_KEY_FILE = 355,
+    VAR_SERVER_CERT_FILE = 356,
+    VAR_CONTROL_KEY_FILE = 357,
+    VAR_CONTROL_CERT_FILE = 358,
+    VAR_CONTROL_USE_CERT = 359,
+    VAR_EXTENDED_STATISTICS = 360,
+    VAR_LOCAL_DATA_PTR = 361,
+    VAR_JOSTLE_TIMEOUT = 362,
+    VAR_STUB_PRIME = 363,
+    VAR_UNWANTED_REPLY_THRESHOLD = 364,
+    VAR_LOG_TIME_ASCII = 365,
+    VAR_DOMAIN_INSECURE = 366,
+    VAR_PYTHON = 367,
+    VAR_PYTHON_SCRIPT = 368,
+    VAR_VAL_SIG_SKEW_MIN = 369,
+    VAR_VAL_SIG_SKEW_MAX = 370,
+    VAR_CACHE_MIN_TTL = 371,
+    VAR_VAL_LOG_LEVEL = 372,
+    VAR_AUTO_TRUST_ANCHOR_FILE = 373,
+    VAR_KEEP_MISSING = 374,
+    VAR_ADD_HOLDDOWN = 375,
+    VAR_DEL_HOLDDOWN = 376,
+    VAR_SO_RCVBUF = 377,
+    VAR_EDNS_BUFFER_SIZE = 378,
+    VAR_PREFETCH = 379,
+    VAR_PREFETCH_KEY = 380,
+    VAR_SO_SNDBUF = 381,
+    VAR_SO_REUSEPORT = 382,
+    VAR_HARDEN_BELOW_NXDOMAIN = 383,
+    VAR_IGNORE_CD_FLAG = 384,
+    VAR_LOG_QUERIES = 385,
+    VAR_LOG_REPLIES = 386,
+    VAR_LOG_LOCAL_ACTIONS = 387,
+    VAR_TCP_UPSTREAM = 388,
+    VAR_SSL_UPSTREAM = 389,
+    VAR_SSL_SERVICE_KEY = 390,
+    VAR_SSL_SERVICE_PEM = 391,
+    VAR_SSL_PORT = 392,
+    VAR_FORWARD_FIRST = 393,
+    VAR_STUB_SSL_UPSTREAM = 394,
+    VAR_FORWARD_SSL_UPSTREAM = 395,
+    VAR_TLS_CERT_BUNDLE = 396,
+    VAR_HTTPS_PORT = 397,
+    VAR_HTTP_ENDPOINT = 398,
+    VAR_HTTP_MAX_STREAMS = 399,
+    VAR_HTTP_QUERY_BUFFER_SIZE = 400,
+    VAR_HTTP_RESPONSE_BUFFER_SIZE = 401,
+    VAR_HTTP_NODELAY = 402,
+    VAR_STUB_FIRST = 403,
+    VAR_MINIMAL_RESPONSES = 404,
+    VAR_RRSET_ROUNDROBIN = 405,
+    VAR_MAX_UDP_SIZE = 406,
+    VAR_DELAY_CLOSE = 407,
+    VAR_UNBLOCK_LAN_ZONES = 408,
+    VAR_INSECURE_LAN_ZONES = 409,
+    VAR_INFRA_CACHE_MIN_RTT = 410,
+    VAR_DNS64_PREFIX = 411,
+    VAR_DNS64_SYNTHALL = 412,
+    VAR_DNS64_IGNORE_AAAA = 413,
+    VAR_DNSTAP = 414,
+    VAR_DNSTAP_ENABLE = 415,
+    VAR_DNSTAP_SOCKET_PATH = 416,
+    VAR_DNSTAP_IP = 417,
+    VAR_DNSTAP_TLS = 418,
+    VAR_DNSTAP_TLS_SERVER_NAME = 419,
+    VAR_DNSTAP_TLS_CERT_BUNDLE = 420,
+    VAR_DNSTAP_TLS_CLIENT_KEY_FILE = 421,
+    VAR_DNSTAP_TLS_CLIENT_CERT_FILE = 422,
+    VAR_DNSTAP_SEND_IDENTITY = 423,
+    VAR_DNSTAP_SEND_VERSION = 424,
+    VAR_DNSTAP_BIDIRECTIONAL = 425,
+    VAR_DNSTAP_IDENTITY = 426,
+    VAR_DNSTAP_VERSION = 427,
+    VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 428,
+    VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 429,
+    VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 430,
+    VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 431,
+    VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 432,
+    VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 433,
+    VAR_RESPONSE_IP_TAG = 434,
+    VAR_RESPONSE_IP = 435,
+    VAR_RESPONSE_IP_DATA = 436,
+    VAR_HARDEN_ALGO_DOWNGRADE = 437,
+    VAR_IP_TRANSPARENT = 438,
+    VAR_IP_DSCP = 439,
+    VAR_DISABLE_DNSSEC_LAME_CHECK = 440,
+    VAR_IP_RATELIMIT = 441,
+    VAR_IP_RATELIMIT_SLABS = 442,
+    VAR_IP_RATELIMIT_SIZE = 443,
+    VAR_RATELIMIT = 444,
+    VAR_RATELIMIT_SLABS = 445,
+    VAR_RATELIMIT_SIZE = 446,
+    VAR_RATELIMIT_FOR_DOMAIN = 447,
+    VAR_RATELIMIT_BELOW_DOMAIN = 448,
+    VAR_IP_RATELIMIT_FACTOR = 449,
+    VAR_RATELIMIT_FACTOR = 450,
+    VAR_SEND_CLIENT_SUBNET = 451,
+    VAR_CLIENT_SUBNET_ZONE = 452,
+    VAR_CLIENT_SUBNET_ALWAYS_FORWARD = 453,
+    VAR_CLIENT_SUBNET_OPCODE = 454,
+    VAR_MAX_CLIENT_SUBNET_IPV4 = 455,
+    VAR_MAX_CLIENT_SUBNET_IPV6 = 456,
+    VAR_MIN_CLIENT_SUBNET_IPV4 = 457,
+    VAR_MIN_CLIENT_SUBNET_IPV6 = 458,
+    VAR_MAX_ECS_TREE_SIZE_IPV4 = 459,
+    VAR_MAX_ECS_TREE_SIZE_IPV6 = 460,
+    VAR_CAPS_WHITELIST = 461,
+    VAR_CACHE_MAX_NEGATIVE_TTL = 462,
+    VAR_PERMIT_SMALL_HOLDDOWN = 463,
+    VAR_QNAME_MINIMISATION = 464,
+    VAR_QNAME_MINIMISATION_STRICT = 465,
+    VAR_IP_FREEBIND = 466,
+    VAR_DEFINE_TAG = 467,
+    VAR_LOCAL_ZONE_TAG = 468,
+    VAR_ACCESS_CONTROL_TAG = 469,
+    VAR_LOCAL_ZONE_OVERRIDE = 470,
+    VAR_ACCESS_CONTROL_TAG_ACTION = 471,
+    VAR_ACCESS_CONTROL_TAG_DATA = 472,
+    VAR_VIEW = 473,
+    VAR_ACCESS_CONTROL_VIEW = 474,
+    VAR_VIEW_FIRST = 475,
+    VAR_SERVE_EXPIRED = 476,
+    VAR_SERVE_EXPIRED_TTL = 477,
+    VAR_SERVE_EXPIRED_TTL_RESET = 478,
+    VAR_SERVE_EXPIRED_REPLY_TTL = 479,
+    VAR_SERVE_EXPIRED_CLIENT_TIMEOUT = 480,
+    VAR_FAKE_DSA = 481,
+    VAR_FAKE_SHA1 = 482,
+    VAR_LOG_IDENTITY = 483,
+    VAR_HIDE_TRUSTANCHOR = 484,
+    VAR_TRUST_ANCHOR_SIGNALING = 485,
+    VAR_AGGRESSIVE_NSEC = 486,
+    VAR_USE_SYSTEMD = 487,
+    VAR_SHM_ENABLE = 488,
+    VAR_SHM_KEY = 489,
+    VAR_ROOT_KEY_SENTINEL = 490,
+    VAR_DNSCRYPT = 491,
+    VAR_DNSCRYPT_ENABLE = 492,
+    VAR_DNSCRYPT_PORT = 493,
+    VAR_DNSCRYPT_PROVIDER = 494,
+    VAR_DNSCRYPT_SECRET_KEY = 495,
+    VAR_DNSCRYPT_PROVIDER_CERT = 496,
+    VAR_DNSCRYPT_PROVIDER_CERT_ROTATED = 497,
+    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 498,
+    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 499,
+    VAR_DNSCRYPT_NONCE_CACHE_SIZE = 500,
+    VAR_DNSCRYPT_NONCE_CACHE_SLABS = 501,
+    VAR_IPSECMOD_ENABLED = 502,
+    VAR_IPSECMOD_HOOK = 503,
+    VAR_IPSECMOD_IGNORE_BOGUS = 504,
+    VAR_IPSECMOD_MAX_TTL = 505,
+    VAR_IPSECMOD_WHITELIST = 506,
+    VAR_IPSECMOD_STRICT = 507,
+    VAR_CACHEDB = 508,
+    VAR_CACHEDB_BACKEND = 509,
+    VAR_CACHEDB_SECRETSEED = 510,
+    VAR_CACHEDB_REDISHOST = 511,
+    VAR_CACHEDB_REDISPORT = 512,
+    VAR_CACHEDB_REDISTIMEOUT = 513,
+    VAR_CACHEDB_REDISEXPIRERECORDS = 514,
+    VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM = 515,
+    VAR_FOR_UPSTREAM = 516,
+    VAR_AUTH_ZONE = 517,
+    VAR_ZONEFILE = 518,
+    VAR_MASTER = 519,
+    VAR_URL = 520,
+    VAR_FOR_DOWNSTREAM = 521,
+    VAR_FALLBACK_ENABLED = 522,
+    VAR_TLS_ADDITIONAL_PORT = 523,
+    VAR_LOW_RTT = 524,
+    VAR_LOW_RTT_PERMIL = 525,
+    VAR_FAST_SERVER_PERMIL = 526,
+    VAR_FAST_SERVER_NUM = 527,
+    VAR_ALLOW_NOTIFY = 528,
+    VAR_TLS_WIN_CERT = 529,
+    VAR_TCP_CONNECTION_LIMIT = 530,
+    VAR_FORWARD_NO_CACHE = 531,
+    VAR_STUB_NO_CACHE = 532,
+    VAR_LOG_SERVFAIL = 533,
+    VAR_DENY_ANY = 534,
+    VAR_UNKNOWN_SERVER_TIME_LIMIT = 535,
+    VAR_LOG_TAG_QUERYREPLY = 536,
+    VAR_STREAM_WAIT_SIZE = 537,
+    VAR_TLS_CIPHERS = 538,
+    VAR_TLS_CIPHERSUITES = 539,
+    VAR_TLS_USE_SNI = 540,
+    VAR_IPSET = 541,
+    VAR_IPSET_NAME_V4 = 542,
+    VAR_IPSET_NAME_V6 = 543,
+    VAR_TLS_SESSION_TICKET_KEYS = 544,
+    VAR_RPZ = 545,
+    VAR_TAGS = 546,
+    VAR_RPZ_ACTION_OVERRIDE = 547,
+    VAR_RPZ_CNAME_OVERRIDE = 548,
+    VAR_RPZ_LOG = 549,
+    VAR_RPZ_LOG_NAME = 550,
+    VAR_DYNLIB = 551,
+    VAR_DYNLIB_FILE = 552,
+    VAR_EDNS_CLIENT_TAG = 553
   };
 #endif
 /* Tokens.  */
@@ -447,291 +450,294 @@ extern int yydebug;
 #define ANY 263
 #define ZONESTR 264
 #define STRING_ARG 265
-#define VAR_SERVER 266
-#define VAR_VERBOSITY 267
-#define VAR_NUM_THREADS 268
-#define VAR_PORT 269
-#define VAR_OUTGOING_RANGE 270
-#define VAR_INTERFACE 271
-#define VAR_PREFER_IP4 272
-#define VAR_DO_IP4 273
-#define VAR_DO_IP6 274
-#define VAR_PREFER_IP6 275
-#define VAR_DO_UDP 276
-#define VAR_DO_TCP 277
-#define VAR_TCP_MSS 278
-#define VAR_OUTGOING_TCP_MSS 279
-#define VAR_TCP_IDLE_TIMEOUT 280
-#define VAR_EDNS_TCP_KEEPALIVE 281
-#define VAR_EDNS_TCP_KEEPALIVE_TIMEOUT 282
-#define VAR_CHROOT 283
-#define VAR_USERNAME 284
-#define VAR_DIRECTORY 285
-#define VAR_LOGFILE 286
-#define VAR_PIDFILE 287
-#define VAR_MSG_CACHE_SIZE 288
-#define VAR_MSG_CACHE_SLABS 289
-#define VAR_NUM_QUERIES_PER_THREAD 290
-#define VAR_RRSET_CACHE_SIZE 291
-#define VAR_RRSET_CACHE_SLABS 292
-#define VAR_OUTGOING_NUM_TCP 293
-#define VAR_INFRA_HOST_TTL 294
-#define VAR_INFRA_LAME_TTL 295
-#define VAR_INFRA_CACHE_SLABS 296
-#define VAR_INFRA_CACHE_NUMHOSTS 297
-#define VAR_INFRA_CACHE_LAME_SIZE 298
-#define VAR_NAME 299
-#define VAR_STUB_ZONE 300
-#define VAR_STUB_HOST 301
-#define VAR_STUB_ADDR 302
-#define VAR_TARGET_FETCH_POLICY 303
-#define VAR_HARDEN_SHORT_BUFSIZE 304
-#define VAR_HARDEN_LARGE_QUERIES 305
-#define VAR_FORWARD_ZONE 306
-#define VAR_FORWARD_HOST 307
-#define VAR_FORWARD_ADDR 308
-#define VAR_DO_NOT_QUERY_ADDRESS 309
-#define VAR_HIDE_IDENTITY 310
-#define VAR_HIDE_VERSION 311
-#define VAR_IDENTITY 312
-#define VAR_VERSION 313
-#define VAR_HARDEN_GLUE 314
-#define VAR_MODULE_CONF 315
-#define VAR_TRUST_ANCHOR_FILE 316
-#define VAR_TRUST_ANCHOR 317
-#define VAR_VAL_OVERRIDE_DATE 318
-#define VAR_BOGUS_TTL 319
-#define VAR_VAL_CLEAN_ADDITIONAL 320
-#define VAR_VAL_PERMISSIVE_MODE 321
-#define VAR_INCOMING_NUM_TCP 322
-#define VAR_MSG_BUFFER_SIZE 323
-#define VAR_KEY_CACHE_SIZE 324
-#define VAR_KEY_CACHE_SLABS 325
-#define VAR_TRUSTED_KEYS_FILE 326
-#define VAR_VAL_NSEC3_KEYSIZE_ITERATIONS 327
-#define VAR_USE_SYSLOG 328
-#define VAR_OUTGOING_INTERFACE 329
-#define VAR_ROOT_HINTS 330
-#define VAR_DO_NOT_QUERY_LOCALHOST 331
-#define VAR_CACHE_MAX_TTL 332
-#define VAR_HARDEN_DNSSEC_STRIPPED 333
-#define VAR_ACCESS_CONTROL 334
-#define VAR_LOCAL_ZONE 335
-#define VAR_LOCAL_DATA 336
-#define VAR_INTERFACE_AUTOMATIC 337
-#define VAR_STATISTICS_INTERVAL 338
-#define VAR_DO_DAEMONIZE 339
-#define VAR_USE_CAPS_FOR_ID 340
-#define VAR_STATISTICS_CUMULATIVE 341
-#define VAR_OUTGOING_PORT_PERMIT 342
-#define VAR_OUTGOING_PORT_AVOID 343
-#define VAR_DLV_ANCHOR_FILE 344
-#define VAR_DLV_ANCHOR 345
-#define VAR_NEG_CACHE_SIZE 346
-#define VAR_HARDEN_REFERRAL_PATH 347
-#define VAR_PRIVATE_ADDRESS 348
-#define VAR_PRIVATE_DOMAIN 349
-#define VAR_REMOTE_CONTROL 350
-#define VAR_CONTROL_ENABLE 351
-#define VAR_CONTROL_INTERFACE 352
-#define VAR_CONTROL_PORT 353
-#define VAR_SERVER_KEY_FILE 354
-#define VAR_SERVER_CERT_FILE 355
-#define VAR_CONTROL_KEY_FILE 356
-#define VAR_CONTROL_CERT_FILE 357
-#define VAR_CONTROL_USE_CERT 358
-#define VAR_EXTENDED_STATISTICS 359
-#define VAR_LOCAL_DATA_PTR 360
-#define VAR_JOSTLE_TIMEOUT 361
-#define VAR_STUB_PRIME 362
-#define VAR_UNWANTED_REPLY_THRESHOLD 363
-#define VAR_LOG_TIME_ASCII 364
-#define VAR_DOMAIN_INSECURE 365
-#define VAR_PYTHON 366
-#define VAR_PYTHON_SCRIPT 367
-#define VAR_VAL_SIG_SKEW_MIN 368
-#define VAR_VAL_SIG_SKEW_MAX 369
-#define VAR_CACHE_MIN_TTL 370
-#define VAR_VAL_LOG_LEVEL 371
-#define VAR_AUTO_TRUST_ANCHOR_FILE 372
-#define VAR_KEEP_MISSING 373
-#define VAR_ADD_HOLDDOWN 374
-#define VAR_DEL_HOLDDOWN 375
-#define VAR_SO_RCVBUF 376
-#define VAR_EDNS_BUFFER_SIZE 377
-#define VAR_PREFETCH 378
-#define VAR_PREFETCH_KEY 379
-#define VAR_SO_SNDBUF 380
-#define VAR_SO_REUSEPORT 381
-#define VAR_HARDEN_BELOW_NXDOMAIN 382
-#define VAR_IGNORE_CD_FLAG 383
-#define VAR_LOG_QUERIES 384
-#define VAR_LOG_REPLIES 385
-#define VAR_LOG_LOCAL_ACTIONS 386
-#define VAR_TCP_UPSTREAM 387
-#define VAR_SSL_UPSTREAM 388
-#define VAR_SSL_SERVICE_KEY 389
-#define VAR_SSL_SERVICE_PEM 390
-#define VAR_SSL_PORT 391
-#define VAR_FORWARD_FIRST 392
-#define VAR_STUB_SSL_UPSTREAM 393
-#define VAR_FORWARD_SSL_UPSTREAM 394
-#define VAR_TLS_CERT_BUNDLE 395
-#define VAR_HTTPS_PORT 396
-#define VAR_HTTP_ENDPOINT 397
-#define VAR_HTTP_MAX_STREAMS 398
-#define VAR_HTTP_QUERY_BUFFER_SIZE 399
-#define VAR_HTTP_RESPONSE_BUFFER_SIZE 400
-#define VAR_HTTP_NODELAY 401
-#define VAR_STUB_FIRST 402
-#define VAR_MINIMAL_RESPONSES 403
-#define VAR_RRSET_ROUNDROBIN 404
-#define VAR_MAX_UDP_SIZE 405
-#define VAR_DELAY_CLOSE 406
-#define VAR_UNBLOCK_LAN_ZONES 407
-#define VAR_INSECURE_LAN_ZONES 408
-#define VAR_INFRA_CACHE_MIN_RTT 409
-#define VAR_DNS64_PREFIX 410
-#define VAR_DNS64_SYNTHALL 411
-#define VAR_DNS64_IGNORE_AAAA 412
-#define VAR_DNSTAP 413
-#define VAR_DNSTAP_ENABLE 414
-#define VAR_DNSTAP_SOCKET_PATH 415
-#define VAR_DNSTAP_IP 416
-#define VAR_DNSTAP_TLS 417
-#define VAR_DNSTAP_TLS_SERVER_NAME 418
-#define VAR_DNSTAP_TLS_CERT_BUNDLE 419
-#define VAR_DNSTAP_TLS_CLIENT_KEY_FILE 420
-#define VAR_DNSTAP_TLS_CLIENT_CERT_FILE 421
-#define VAR_DNSTAP_SEND_IDENTITY 422
-#define VAR_DNSTAP_SEND_VERSION 423
-#define VAR_DNSTAP_IDENTITY 424
-#define VAR_DNSTAP_VERSION 425
-#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 426
-#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 427
-#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 428
-#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 429
-#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 430
-#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 431
-#define VAR_RESPONSE_IP_TAG 432
-#define VAR_RESPONSE_IP 433
-#define VAR_RESPONSE_IP_DATA 434
-#define VAR_HARDEN_ALGO_DOWNGRADE 435
-#define VAR_IP_TRANSPARENT 436
-#define VAR_IP_DSCP 437
-#define VAR_DISABLE_DNSSEC_LAME_CHECK 438
-#define VAR_IP_RATELIMIT 439
-#define VAR_IP_RATELIMIT_SLABS 440
-#define VAR_IP_RATELIMIT_SIZE 441
-#define VAR_RATELIMIT 442
-#define VAR_RATELIMIT_SLABS 443
-#define VAR_RATELIMIT_SIZE 444
-#define VAR_RATELIMIT_FOR_DOMAIN 445
-#define VAR_RATELIMIT_BELOW_DOMAIN 446
-#define VAR_IP_RATELIMIT_FACTOR 447
-#define VAR_RATELIMIT_FACTOR 448
-#define VAR_SEND_CLIENT_SUBNET 449
-#define VAR_CLIENT_SUBNET_ZONE 450
-#define VAR_CLIENT_SUBNET_ALWAYS_FORWARD 451
-#define VAR_CLIENT_SUBNET_OPCODE 452
-#define VAR_MAX_CLIENT_SUBNET_IPV4 453
-#define VAR_MAX_CLIENT_SUBNET_IPV6 454
-#define VAR_MIN_CLIENT_SUBNET_IPV4 455
-#define VAR_MIN_CLIENT_SUBNET_IPV6 456
-#define VAR_MAX_ECS_TREE_SIZE_IPV4 457
-#define VAR_MAX_ECS_TREE_SIZE_IPV6 458
-#define VAR_CAPS_WHITELIST 459
-#define VAR_CACHE_MAX_NEGATIVE_TTL 460
-#define VAR_PERMIT_SMALL_HOLDDOWN 461
-#define VAR_QNAME_MINIMISATION 462
-#define VAR_QNAME_MINIMISATION_STRICT 463
-#define VAR_IP_FREEBIND 464
-#define VAR_DEFINE_TAG 465
-#define VAR_LOCAL_ZONE_TAG 466
-#define VAR_ACCESS_CONTROL_TAG 467
-#define VAR_LOCAL_ZONE_OVERRIDE 468
-#define VAR_ACCESS_CONTROL_TAG_ACTION 469
-#define VAR_ACCESS_CONTROL_TAG_DATA 470
-#define VAR_VIEW 471
-#define VAR_ACCESS_CONTROL_VIEW 472
-#define VAR_VIEW_FIRST 473
-#define VAR_SERVE_EXPIRED 474
-#define VAR_SERVE_EXPIRED_TTL 475
-#define VAR_SERVE_EXPIRED_TTL_RESET 476
-#define VAR_SERVE_EXPIRED_REPLY_TTL 477
-#define VAR_SERVE_EXPIRED_CLIENT_TIMEOUT 478
-#define VAR_FAKE_DSA 479
-#define VAR_FAKE_SHA1 480
-#define VAR_LOG_IDENTITY 481
-#define VAR_HIDE_TRUSTANCHOR 482
-#define VAR_TRUST_ANCHOR_SIGNALING 483
-#define VAR_AGGRESSIVE_NSEC 484
-#define VAR_USE_SYSTEMD 485
-#define VAR_SHM_ENABLE 486
-#define VAR_SHM_KEY 487
-#define VAR_ROOT_KEY_SENTINEL 488
-#define VAR_DNSCRYPT 489
-#define VAR_DNSCRYPT_ENABLE 490
-#define VAR_DNSCRYPT_PORT 491
-#define VAR_DNSCRYPT_PROVIDER 492
-#define VAR_DNSCRYPT_SECRET_KEY 493
-#define VAR_DNSCRYPT_PROVIDER_CERT 494
-#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 495
-#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 496
-#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 497
-#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 498
-#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 499
-#define VAR_IPSECMOD_ENABLED 500
-#define VAR_IPSECMOD_HOOK 501
-#define VAR_IPSECMOD_IGNORE_BOGUS 502
-#define VAR_IPSECMOD_MAX_TTL 503
-#define VAR_IPSECMOD_WHITELIST 504
-#define VAR_IPSECMOD_STRICT 505
-#define VAR_CACHEDB 506
-#define VAR_CACHEDB_BACKEND 507
-#define VAR_CACHEDB_SECRETSEED 508
-#define VAR_CACHEDB_REDISHOST 509
-#define VAR_CACHEDB_REDISPORT 510
-#define VAR_CACHEDB_REDISTIMEOUT 511
-#define VAR_CACHEDB_REDISEXPIRERECORDS 512
-#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 513
-#define VAR_FOR_UPSTREAM 514
-#define VAR_AUTH_ZONE 515
-#define VAR_ZONEFILE 516
-#define VAR_MASTER 517
-#define VAR_URL 518
-#define VAR_FOR_DOWNSTREAM 519
-#define VAR_FALLBACK_ENABLED 520
-#define VAR_TLS_ADDITIONAL_PORT 521
-#define VAR_LOW_RTT 522
-#define VAR_LOW_RTT_PERMIL 523
-#define VAR_FAST_SERVER_PERMIL 524
-#define VAR_FAST_SERVER_NUM 525
-#define VAR_ALLOW_NOTIFY 526
-#define VAR_TLS_WIN_CERT 527
-#define VAR_TCP_CONNECTION_LIMIT 528
-#define VAR_FORWARD_NO_CACHE 529
-#define VAR_STUB_NO_CACHE 530
-#define VAR_LOG_SERVFAIL 531
-#define VAR_DENY_ANY 532
-#define VAR_UNKNOWN_SERVER_TIME_LIMIT 533
-#define VAR_LOG_TAG_QUERYREPLY 534
-#define VAR_STREAM_WAIT_SIZE 535
-#define VAR_TLS_CIPHERS 536
-#define VAR_TLS_CIPHERSUITES 537
-#define VAR_TLS_USE_SNI 538
-#define VAR_IPSET 539
-#define VAR_IPSET_NAME_V4 540
-#define VAR_IPSET_NAME_V6 541
-#define VAR_TLS_SESSION_TICKET_KEYS 542
-#define VAR_RPZ 543
-#define VAR_TAGS 544
-#define VAR_RPZ_ACTION_OVERRIDE 545
-#define VAR_RPZ_CNAME_OVERRIDE 546
-#define VAR_RPZ_LOG 547
-#define VAR_RPZ_LOG_NAME 548
-#define VAR_DYNLIB 549
-#define VAR_DYNLIB_FILE 550
+#define VAR_FORCE_TOPLEVEL 266
+#define VAR_SERVER 267
+#define VAR_VERBOSITY 268
+#define VAR_NUM_THREADS 269
+#define VAR_PORT 270
+#define VAR_OUTGOING_RANGE 271
+#define VAR_INTERFACE 272
+#define VAR_PREFER_IP4 273
+#define VAR_DO_IP4 274
+#define VAR_DO_IP6 275
+#define VAR_PREFER_IP6 276
+#define VAR_DO_UDP 277
+#define VAR_DO_TCP 278
+#define VAR_TCP_MSS 279
+#define VAR_OUTGOING_TCP_MSS 280
+#define VAR_TCP_IDLE_TIMEOUT 281
+#define VAR_EDNS_TCP_KEEPALIVE 282
+#define VAR_EDNS_TCP_KEEPALIVE_TIMEOUT 283
+#define VAR_CHROOT 284
+#define VAR_USERNAME 285
+#define VAR_DIRECTORY 286
+#define VAR_LOGFILE 287
+#define VAR_PIDFILE 288
+#define VAR_MSG_CACHE_SIZE 289
+#define VAR_MSG_CACHE_SLABS 290
+#define VAR_NUM_QUERIES_PER_THREAD 291
+#define VAR_RRSET_CACHE_SIZE 292
+#define VAR_RRSET_CACHE_SLABS 293
+#define VAR_OUTGOING_NUM_TCP 294
+#define VAR_INFRA_HOST_TTL 295
+#define VAR_INFRA_LAME_TTL 296
+#define VAR_INFRA_CACHE_SLABS 297
+#define VAR_INFRA_CACHE_NUMHOSTS 298
+#define VAR_INFRA_CACHE_LAME_SIZE 299
+#define VAR_NAME 300
+#define VAR_STUB_ZONE 301
+#define VAR_STUB_HOST 302
+#define VAR_STUB_ADDR 303
+#define VAR_TARGET_FETCH_POLICY 304
+#define VAR_HARDEN_SHORT_BUFSIZE 305
+#define VAR_HARDEN_LARGE_QUERIES 306
+#define VAR_FORWARD_ZONE 307
+#define VAR_FORWARD_HOST 308
+#define VAR_FORWARD_ADDR 309
+#define VAR_DO_NOT_QUERY_ADDRESS 310
+#define VAR_HIDE_IDENTITY 311
+#define VAR_HIDE_VERSION 312
+#define VAR_IDENTITY 313
+#define VAR_VERSION 314
+#define VAR_HARDEN_GLUE 315
+#define VAR_MODULE_CONF 316
+#define VAR_TRUST_ANCHOR_FILE 317
+#define VAR_TRUST_ANCHOR 318
+#define VAR_VAL_OVERRIDE_DATE 319
+#define VAR_BOGUS_TTL 320
+#define VAR_VAL_CLEAN_ADDITIONAL 321
+#define VAR_VAL_PERMISSIVE_MODE 322
+#define VAR_INCOMING_NUM_TCP 323
+#define VAR_MSG_BUFFER_SIZE 324
+#define VAR_KEY_CACHE_SIZE 325
+#define VAR_KEY_CACHE_SLABS 326
+#define VAR_TRUSTED_KEYS_FILE 327
+#define VAR_VAL_NSEC3_KEYSIZE_ITERATIONS 328
+#define VAR_USE_SYSLOG 329
+#define VAR_OUTGOING_INTERFACE 330
+#define VAR_ROOT_HINTS 331
+#define VAR_DO_NOT_QUERY_LOCALHOST 332
+#define VAR_CACHE_MAX_TTL 333
+#define VAR_HARDEN_DNSSEC_STRIPPED 334
+#define VAR_ACCESS_CONTROL 335
+#define VAR_LOCAL_ZONE 336
+#define VAR_LOCAL_DATA 337
+#define VAR_INTERFACE_AUTOMATIC 338
+#define VAR_STATISTICS_INTERVAL 339
+#define VAR_DO_DAEMONIZE 340
+#define VAR_USE_CAPS_FOR_ID 341
+#define VAR_STATISTICS_CUMULATIVE 342
+#define VAR_OUTGOING_PORT_PERMIT 343
+#define VAR_OUTGOING_PORT_AVOID 344
+#define VAR_DLV_ANCHOR_FILE 345
+#define VAR_DLV_ANCHOR 346
+#define VAR_NEG_CACHE_SIZE 347
+#define VAR_HARDEN_REFERRAL_PATH 348
+#define VAR_PRIVATE_ADDRESS 349
+#define VAR_PRIVATE_DOMAIN 350
+#define VAR_REMOTE_CONTROL 351
+#define VAR_CONTROL_ENABLE 352
+#define VAR_CONTROL_INTERFACE 353
+#define VAR_CONTROL_PORT 354
+#define VAR_SERVER_KEY_FILE 355
+#define VAR_SERVER_CERT_FILE 356
+#define VAR_CONTROL_KEY_FILE 357
+#define VAR_CONTROL_CERT_FILE 358
+#define VAR_CONTROL_USE_CERT 359
+#define VAR_EXTENDED_STATISTICS 360
+#define VAR_LOCAL_DATA_PTR 361
+#define VAR_JOSTLE_TIMEOUT 362
+#define VAR_STUB_PRIME 363
+#define VAR_UNWANTED_REPLY_THRESHOLD 364
+#define VAR_LOG_TIME_ASCII 365
+#define VAR_DOMAIN_INSECURE 366
+#define VAR_PYTHON 367
+#define VAR_PYTHON_SCRIPT 368
+#define VAR_VAL_SIG_SKEW_MIN 369
+#define VAR_VAL_SIG_SKEW_MAX 370
+#define VAR_CACHE_MIN_TTL 371
+#define VAR_VAL_LOG_LEVEL 372
+#define VAR_AUTO_TRUST_ANCHOR_FILE 373
+#define VAR_KEEP_MISSING 374
+#define VAR_ADD_HOLDDOWN 375
+#define VAR_DEL_HOLDDOWN 376
+#define VAR_SO_RCVBUF 377
+#define VAR_EDNS_BUFFER_SIZE 378
+#define VAR_PREFETCH 379
+#define VAR_PREFETCH_KEY 380
+#define VAR_SO_SNDBUF 381
+#define VAR_SO_REUSEPORT 382
+#define VAR_HARDEN_BELOW_NXDOMAIN 383
+#define VAR_IGNORE_CD_FLAG 384
+#define VAR_LOG_QUERIES 385
+#define VAR_LOG_REPLIES 386
+#define VAR_LOG_LOCAL_ACTIONS 387
+#define VAR_TCP_UPSTREAM 388
+#define VAR_SSL_UPSTREAM 389
+#define VAR_SSL_SERVICE_KEY 390
+#define VAR_SSL_SERVICE_PEM 391
+#define VAR_SSL_PORT 392
+#define VAR_FORWARD_FIRST 393
+#define VAR_STUB_SSL_UPSTREAM 394
+#define VAR_FORWARD_SSL_UPSTREAM 395
+#define VAR_TLS_CERT_BUNDLE 396
+#define VAR_HTTPS_PORT 397
+#define VAR_HTTP_ENDPOINT 398
+#define VAR_HTTP_MAX_STREAMS 399
+#define VAR_HTTP_QUERY_BUFFER_SIZE 400
+#define VAR_HTTP_RESPONSE_BUFFER_SIZE 401
+#define VAR_HTTP_NODELAY 402
+#define VAR_STUB_FIRST 403
+#define VAR_MINIMAL_RESPONSES 404
+#define VAR_RRSET_ROUNDROBIN 405
+#define VAR_MAX_UDP_SIZE 406
+#define VAR_DELAY_CLOSE 407
+#define VAR_UNBLOCK_LAN_ZONES 408
+#define VAR_INSECURE_LAN_ZONES 409
+#define VAR_INFRA_CACHE_MIN_RTT 410
+#define VAR_DNS64_PREFIX 411
+#define VAR_DNS64_SYNTHALL 412
+#define VAR_DNS64_IGNORE_AAAA 413
+#define VAR_DNSTAP 414
+#define VAR_DNSTAP_ENABLE 415
+#define VAR_DNSTAP_SOCKET_PATH 416
+#define VAR_DNSTAP_IP 417
+#define VAR_DNSTAP_TLS 418
+#define VAR_DNSTAP_TLS_SERVER_NAME 419
+#define VAR_DNSTAP_TLS_CERT_BUNDLE 420
+#define VAR_DNSTAP_TLS_CLIENT_KEY_FILE 421
+#define VAR_DNSTAP_TLS_CLIENT_CERT_FILE 422
+#define VAR_DNSTAP_SEND_IDENTITY 423
+#define VAR_DNSTAP_SEND_VERSION 424
+#define VAR_DNSTAP_BIDIRECTIONAL 425
+#define VAR_DNSTAP_IDENTITY 426
+#define VAR_DNSTAP_VERSION 427
+#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 428
+#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 429
+#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 430
+#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 431
+#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 432
+#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 433
+#define VAR_RESPONSE_IP_TAG 434
+#define VAR_RESPONSE_IP 435
+#define VAR_RESPONSE_IP_DATA 436
+#define VAR_HARDEN_ALGO_DOWNGRADE 437
+#define VAR_IP_TRANSPARENT 438
+#define VAR_IP_DSCP 439
+#define VAR_DISABLE_DNSSEC_LAME_CHECK 440
+#define VAR_IP_RATELIMIT 441
+#define VAR_IP_RATELIMIT_SLABS 442
+#define VAR_IP_RATELIMIT_SIZE 443
+#define VAR_RATELIMIT 444
+#define VAR_RATELIMIT_SLABS 445
+#define VAR_RATELIMIT_SIZE 446
+#define VAR_RATELIMIT_FOR_DOMAIN 447
+#define VAR_RATELIMIT_BELOW_DOMAIN 448
+#define VAR_IP_RATELIMIT_FACTOR 449
+#define VAR_RATELIMIT_FACTOR 450
+#define VAR_SEND_CLIENT_SUBNET 451
+#define VAR_CLIENT_SUBNET_ZONE 452
+#define VAR_CLIENT_SUBNET_ALWAYS_FORWARD 453
+#define VAR_CLIENT_SUBNET_OPCODE 454
+#define VAR_MAX_CLIENT_SUBNET_IPV4 455
+#define VAR_MAX_CLIENT_SUBNET_IPV6 456
+#define VAR_MIN_CLIENT_SUBNET_IPV4 457
+#define VAR_MIN_CLIENT_SUBNET_IPV6 458
+#define VAR_MAX_ECS_TREE_SIZE_IPV4 459
+#define VAR_MAX_ECS_TREE_SIZE_IPV6 460
+#define VAR_CAPS_WHITELIST 461
+#define VAR_CACHE_MAX_NEGATIVE_TTL 462
+#define VAR_PERMIT_SMALL_HOLDDOWN 463
+#define VAR_QNAME_MINIMISATION 464
+#define VAR_QNAME_MINIMISATION_STRICT 465
+#define VAR_IP_FREEBIND 466
+#define VAR_DEFINE_TAG 467
+#define VAR_LOCAL_ZONE_TAG 468
+#define VAR_ACCESS_CONTROL_TAG 469
+#define VAR_LOCAL_ZONE_OVERRIDE 470
+#define VAR_ACCESS_CONTROL_TAG_ACTION 471
+#define VAR_ACCESS_CONTROL_TAG_DATA 472
+#define VAR_VIEW 473
+#define VAR_ACCESS_CONTROL_VIEW 474
+#define VAR_VIEW_FIRST 475
+#define VAR_SERVE_EXPIRED 476
+#define VAR_SERVE_EXPIRED_TTL 477
+#define VAR_SERVE_EXPIRED_TTL_RESET 478
+#define VAR_SERVE_EXPIRED_REPLY_TTL 479
+#define VAR_SERVE_EXPIRED_CLIENT_TIMEOUT 480
+#define VAR_FAKE_DSA 481
+#define VAR_FAKE_SHA1 482
+#define VAR_LOG_IDENTITY 483
+#define VAR_HIDE_TRUSTANCHOR 484
+#define VAR_TRUST_ANCHOR_SIGNALING 485
+#define VAR_AGGRESSIVE_NSEC 486
+#define VAR_USE_SYSTEMD 487
+#define VAR_SHM_ENABLE 488
+#define VAR_SHM_KEY 489
+#define VAR_ROOT_KEY_SENTINEL 490
+#define VAR_DNSCRYPT 491
+#define VAR_DNSCRYPT_ENABLE 492
+#define VAR_DNSCRYPT_PORT 493
+#define VAR_DNSCRYPT_PROVIDER 494
+#define VAR_DNSCRYPT_SECRET_KEY 495
+#define VAR_DNSCRYPT_PROVIDER_CERT 496
+#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 497
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 498
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 499
+#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 500
+#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 501
+#define VAR_IPSECMOD_ENABLED 502
+#define VAR_IPSECMOD_HOOK 503
+#define VAR_IPSECMOD_IGNORE_BOGUS 504
+#define VAR_IPSECMOD_MAX_TTL 505
+#define VAR_IPSECMOD_WHITELIST 506
+#define VAR_IPSECMOD_STRICT 507
+#define VAR_CACHEDB 508
+#define VAR_CACHEDB_BACKEND 509
+#define VAR_CACHEDB_SECRETSEED 510
+#define VAR_CACHEDB_REDISHOST 511
+#define VAR_CACHEDB_REDISPORT 512
+#define VAR_CACHEDB_REDISTIMEOUT 513
+#define VAR_CACHEDB_REDISEXPIRERECORDS 514
+#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 515
+#define VAR_FOR_UPSTREAM 516
+#define VAR_AUTH_ZONE 517
+#define VAR_ZONEFILE 518
+#define VAR_MASTER 519
+#define VAR_URL 520
+#define VAR_FOR_DOWNSTREAM 521
+#define VAR_FALLBACK_ENABLED 522
+#define VAR_TLS_ADDITIONAL_PORT 523
+#define VAR_LOW_RTT 524
+#define VAR_LOW_RTT_PERMIL 525
+#define VAR_FAST_SERVER_PERMIL 526
+#define VAR_FAST_SERVER_NUM 527
+#define VAR_ALLOW_NOTIFY 528
+#define VAR_TLS_WIN_CERT 529
+#define VAR_TCP_CONNECTION_LIMIT 530
+#define VAR_FORWARD_NO_CACHE 531
+#define VAR_STUB_NO_CACHE 532
+#define VAR_LOG_SERVFAIL 533
+#define VAR_DENY_ANY 534
+#define VAR_UNKNOWN_SERVER_TIME_LIMIT 535
+#define VAR_LOG_TAG_QUERYREPLY 536
+#define VAR_STREAM_WAIT_SIZE 537
+#define VAR_TLS_CIPHERS 538
+#define VAR_TLS_CIPHERSUITES 539
+#define VAR_TLS_USE_SNI 540
+#define VAR_IPSET 541
+#define VAR_IPSET_NAME_V4 542
+#define VAR_IPSET_NAME_V6 543
+#define VAR_TLS_SESSION_TICKET_KEYS 544
+#define VAR_RPZ 545
+#define VAR_TAGS 546
+#define VAR_RPZ_ACTION_OVERRIDE 547
+#define VAR_RPZ_CNAME_OVERRIDE 548
+#define VAR_RPZ_LOG 549
+#define VAR_RPZ_LOG_NAME 550
+#define VAR_DYNLIB 551
+#define VAR_DYNLIB_FILE 552
+#define VAR_EDNS_CLIENT_TAG 553
 
 /* Value type.  */
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
@@ -741,7 +747,7 @@ union YYSTYPE
 
 	char*	str;
 
-#line 745 "util/configparser.c"
+#line 751 "util/configparser.c"
 
 };
 typedef union YYSTYPE YYSTYPE;
@@ -1060,19 +1066,19 @@ union yyalloc
 /* YYFINAL -- State number of the termination state.  */
 #define YYFINAL  2
 /* YYLAST -- Last index in YYTABLE.  */
-#define YYLAST   627
+#define YYLAST   634
 
 /* YYNTOKENS -- Number of terminals.  */
-#define YYNTOKENS  296
+#define YYNTOKENS  299
 /* YYNNTS -- Number of nonterminals.  */
-#define YYNNTS  321
+#define YYNNTS  324
 /* YYNRULES -- Number of rules.  */
-#define YYNRULES  618
+#define YYNRULES  624
 /* YYNSTATES -- Number of states.  */
-#define YYNSTATES  918
+#define YYNSTATES  927
 
 #define YYUNDEFTOK  2
-#define YYMAXUTOK   550
+#define YYMAXUTOK   553
 
 
 /* YYTRANSLATE(TOKEN-NUM) -- Symbol number corresponding to TOKEN-NUM
@@ -1139,75 +1145,76 @@ static const yytype_int16 yytranslate[] =
      265,   266,   267,   268,   269,   270,   271,   272,   273,   274,
      275,   276,   277,   278,   279,   280,   281,   282,   283,   284,
      285,   286,   287,   288,   289,   290,   291,   292,   293,   294,
-     295
+     295,   296,   297,   298
 };
 
 #if YYDEBUG
   /* YYRLINE[YYN] -- Source line where rule number YYN was defined.  */
 static const yytype_int16 yyrline[] =
 {
-       0,   183,   183,   183,   184,   184,   185,   185,   186,   186,
-     186,   187,   187,   188,   188,   189,   189,   193,   198,   199,
-     200,   200,   200,   201,   201,   202,   202,   202,   203,   203,
-     204,   204,   204,   205,   205,   206,   206,   206,   207,   207,
-     207,   208,   208,   209,   209,   210,   210,   211,   211,   212,
-     212,   213,   213,   214,   214,   215,   215,   216,   216,   216,
-     217,   217,   217,   218,   218,   218,   219,   219,   220,   220,
-     221,   221,   222,   222,   223,   223,   223,   224,   224,   225,
-     225,   226,   226,   226,   227,   227,   228,   228,   229,   229,
-     230,   230,   230,   231,   231,   232,   232,   233,   233,   234,
-     234,   235,   235,   236,   236,   236,   237,   237,   238,   238,
-     238,   239,   239,   239,   240,   240,   240,   241,   241,   241,
-     241,   242,   243,   243,   243,   244,   244,   244,   245,   245,
-     246,   247,   247,   247,   248,   248,   249,   249,   250,   250,
-     250,   251,   251,   252,   252,   252,   253,   254,   254,   255,
-     255,   256,   257,   257,   258,   258,   259,   259,   260,   261,
-     261,   262,   262,   263,   263,   264,   264,   265,   265,   266,
-     266,   266,   267,   267,   268,   268,   269,   269,   270,   270,
-     271,   271,   272,   272,   273,   273,   273,   274,   274,   274,
-     275,   275,   275,   276,   276,   277,   278,   278,   279,   279,
-     280,   280,   281,   281,   282,   282,   282,   283,   283,   283,
-     284,   284,   284,   285,   285,   286,   286,   287,   287,   288,
-     290,   302,   303,   304,   304,   304,   304,   304,   305,   305,
-     307,   319,   320,   321,   321,   321,   321,   322,   322,   324,
-     338,   339,   340,   340,   340,   340,   341,   341,   341,   343,
-     360,   361,   362,   362,   362,   362,   363,   363,   363,   364,
-     367,   386,   403,   411,   421,   429,   446,   447,   448,   448,
-     448,   448,   448,   449,   449,   449,   450,   450,   452,   461,
-     470,   481,   490,   499,   508,   519,   528,   540,   554,   569,
-     580,   597,   614,   631,   648,   663,   678,   691,   706,   715,
-     724,   733,   742,   751,   760,   769,   778,   787,   796,   805,
-     814,   823,   832,   845,   854,   867,   876,   885,   894,   901,
-     908,   917,   924,   933,   941,   948,   955,   963,   972,   979,
-     993,  1001,  1009,  1017,  1025,  1034,  1043,  1057,  1066,  1075,
-    1084,  1093,  1102,  1111,  1118,  1125,  1151,  1159,  1166,  1173,
-    1180,  1187,  1195,  1203,  1211,  1218,  1229,  1240,  1247,  1256,
-    1265,  1274,  1281,  1288,  1296,  1304,  1314,  1324,  1334,  1348,
-    1356,  1369,  1380,  1388,  1401,  1410,  1419,  1428,  1438,  1448,
-    1456,  1469,  1478,  1486,  1495,  1503,  1516,  1525,  1532,  1542,
-    1552,  1562,  1572,  1582,  1592,  1602,  1612,  1619,  1626,  1633,
-    1642,  1651,  1660,  1669,  1676,  1686,  1706,  1713,  1731,  1744,
-    1757,  1766,  1775,  1784,  1793,  1803,  1813,  1824,  1833,  1842,
-    1851,  1860,  1869,  1878,  1891,  1904,  1913,  1920,  1929,  1938,
-    1947,  1956,  1964,  1977,  1985,  2026,  2033,  2048,  2058,  2068,
-    2075,  2082,  2089,  2098,  2106,  2120,  2141,  2162,  2174,  2186,
-    2198,  2207,  2228,  2238,  2247,  2255,  2263,  2276,  2289,  2304,
-    2319,  2328,  2337,  2343,  2352,  2361,  2371,  2381,  2394,  2407,
-    2419,  2433,  2445,  2459,  2469,  2476,  2483,  2492,  2501,  2511,
-    2521,  2531,  2538,  2545,  2554,  2563,  2573,  2583,  2590,  2597,
-    2604,  2612,  2622,  2632,  2642,  2652,  2691,  2701,  2709,  2717,
-    2732,  2741,  2746,  2747,  2748,  2748,  2748,  2749,  2749,  2749,
-    2750,  2750,  2752,  2762,  2771,  2778,  2785,  2792,  2799,  2806,
-    2813,  2818,  2819,  2820,  2820,  2821,  2821,  2821,  2822,  2823,
-    2823,  2824,  2824,  2825,  2825,  2826,  2827,  2828,  2829,  2830,
-    2831,  2833,  2842,  2849,  2856,  2865,  2872,  2879,  2886,  2893,
-    2902,  2911,  2918,  2925,  2935,  2945,  2955,  2965,  2975,  2985,
-    2990,  2991,  2992,  2994,  3000,  3005,  3006,  3007,  3009,  3015,
-    3025,  3032,  3041,  3049,  3054,  3055,  3057,  3057,  3057,  3058,
-    3058,  3059,  3060,  3061,  3062,  3063,  3065,  3075,  3084,  3091,
-    3100,  3107,  3116,  3124,  3137,  3145,  3158,  3163,  3164,  3165,
-    3165,  3166,  3166,  3166,  3167,  3169,  3181,  3193,  3205,  3220,
-    3233,  3246,  3257,  3262,  3263,  3264,  3264,  3266,  3281
+       0,   184,   184,   184,   185,   185,   186,   186,   187,   187,
+     187,   188,   188,   189,   189,   190,   190,   191,   193,   199,
+     204,   205,   206,   206,   206,   207,   207,   208,   208,   208,
+     209,   209,   210,   210,   210,   211,   211,   212,   212,   212,
+     213,   213,   213,   214,   214,   215,   215,   216,   216,   217,
+     217,   218,   218,   219,   219,   220,   220,   221,   221,   222,
+     222,   222,   223,   223,   223,   224,   224,   224,   225,   225,
+     226,   226,   227,   227,   228,   228,   229,   229,   229,   230,
+     230,   231,   231,   232,   232,   232,   233,   233,   234,   234,
+     235,   235,   236,   236,   236,   237,   237,   238,   238,   239,
+     239,   240,   240,   241,   241,   242,   242,   242,   243,   243,
+     244,   244,   244,   245,   245,   245,   246,   246,   246,   247,
+     247,   247,   247,   248,   249,   249,   249,   250,   250,   250,
+     251,   251,   252,   253,   253,   253,   254,   254,   255,   255,
+     256,   256,   256,   257,   257,   258,   258,   258,   259,   260,
+     260,   261,   261,   262,   263,   263,   264,   264,   265,   265,
+     266,   267,   267,   268,   268,   269,   269,   270,   270,   271,
+     271,   272,   272,   272,   273,   273,   274,   274,   275,   275,
+     276,   276,   277,   277,   278,   278,   279,   279,   279,   280,
+     280,   280,   281,   281,   281,   282,   282,   283,   284,   284,
+     285,   285,   286,   286,   287,   287,   288,   288,   288,   289,
+     289,   289,   290,   290,   290,   291,   291,   292,   292,   293,
+     293,   294,   294,   296,   308,   309,   310,   310,   310,   310,
+     310,   311,   311,   313,   325,   326,   327,   327,   327,   327,
+     328,   328,   330,   344,   345,   346,   346,   346,   346,   347,
+     347,   347,   349,   366,   367,   368,   368,   368,   368,   369,
+     369,   369,   370,   373,   392,   409,   417,   427,   435,   452,
+     453,   454,   454,   454,   454,   454,   455,   455,   455,   456,
+     456,   458,   467,   476,   487,   496,   505,   514,   525,   534,
+     546,   560,   575,   586,   603,   620,   637,   654,   669,   684,
+     697,   712,   721,   730,   739,   748,   757,   766,   775,   784,
+     793,   802,   811,   820,   829,   838,   851,   860,   873,   882,
+     891,   900,   907,   914,   923,   930,   939,   947,   954,   961,
+     969,   978,   985,  1001,  1009,  1017,  1025,  1033,  1042,  1051,
+    1065,  1074,  1083,  1092,  1101,  1110,  1119,  1126,  1133,  1159,
+    1167,  1174,  1181,  1188,  1195,  1203,  1211,  1219,  1226,  1237,
+    1248,  1255,  1264,  1273,  1282,  1289,  1296,  1304,  1312,  1322,
+    1332,  1342,  1356,  1364,  1377,  1388,  1396,  1409,  1418,  1427,
+    1436,  1446,  1456,  1464,  1477,  1486,  1494,  1503,  1511,  1524,
+    1533,  1540,  1550,  1560,  1570,  1580,  1590,  1600,  1610,  1620,
+    1627,  1634,  1641,  1650,  1659,  1668,  1677,  1684,  1694,  1714,
+    1721,  1739,  1752,  1765,  1774,  1783,  1792,  1801,  1811,  1821,
+    1832,  1841,  1850,  1859,  1868,  1877,  1886,  1899,  1912,  1921,
+    1928,  1937,  1946,  1955,  1964,  1972,  1985,  1993,  2034,  2041,
+    2056,  2066,  2076,  2083,  2090,  2097,  2106,  2114,  2128,  2149,
+    2170,  2182,  2194,  2206,  2215,  2236,  2246,  2255,  2263,  2271,
+    2284,  2297,  2312,  2327,  2336,  2345,  2351,  2360,  2369,  2379,
+    2389,  2402,  2415,  2427,  2441,  2453,  2467,  2482,  2492,  2499,
+    2506,  2515,  2524,  2534,  2544,  2554,  2561,  2568,  2577,  2586,
+    2596,  2606,  2613,  2620,  2627,  2635,  2645,  2655,  2665,  2675,
+    2714,  2724,  2732,  2740,  2755,  2764,  2769,  2770,  2771,  2771,
+    2771,  2772,  2772,  2772,  2773,  2773,  2775,  2785,  2794,  2801,
+    2808,  2815,  2822,  2829,  2836,  2841,  2842,  2843,  2843,  2843,
+    2844,  2844,  2844,  2845,  2846,  2846,  2847,  2847,  2848,  2848,
+    2849,  2850,  2851,  2852,  2853,  2854,  2856,  2865,  2875,  2882,
+    2889,  2898,  2905,  2912,  2919,  2926,  2935,  2944,  2951,  2958,
+    2968,  2978,  2988,  2998,  3008,  3018,  3023,  3024,  3025,  3027,
+    3033,  3038,  3039,  3040,  3042,  3048,  3058,  3065,  3074,  3082,
+    3087,  3088,  3090,  3090,  3090,  3091,  3091,  3092,  3093,  3094,
+    3095,  3096,  3098,  3108,  3117,  3124,  3133,  3140,  3149,  3157,
+    3170,  3178,  3191,  3196,  3197,  3198,  3198,  3199,  3199,  3199,
+    3200,  3202,  3214,  3226,  3238,  3253,  3266,  3279,  3290,  3295,
+    3296,  3297,  3297,  3299,  3314
 };
 #endif
 
@@ -1217,16 +1224,17 @@ static const yytype_int16 yyrline[] =
 static const char *const yytname[] =
 {
   "$end", "error", "$undefined", "SPACE", "LETTER", "NEWLINE", "COMMENT",
-  "COLON", "ANY", "ZONESTR", "STRING_ARG", "VAR_SERVER", "VAR_VERBOSITY",
-  "VAR_NUM_THREADS", "VAR_PORT", "VAR_OUTGOING_RANGE", "VAR_INTERFACE",
-  "VAR_PREFER_IP4", "VAR_DO_IP4", "VAR_DO_IP6", "VAR_PREFER_IP6",
-  "VAR_DO_UDP", "VAR_DO_TCP", "VAR_TCP_MSS", "VAR_OUTGOING_TCP_MSS",
-  "VAR_TCP_IDLE_TIMEOUT", "VAR_EDNS_TCP_KEEPALIVE",
-  "VAR_EDNS_TCP_KEEPALIVE_TIMEOUT", "VAR_CHROOT", "VAR_USERNAME",
-  "VAR_DIRECTORY", "VAR_LOGFILE", "VAR_PIDFILE", "VAR_MSG_CACHE_SIZE",
-  "VAR_MSG_CACHE_SLABS", "VAR_NUM_QUERIES_PER_THREAD",
-  "VAR_RRSET_CACHE_SIZE", "VAR_RRSET_CACHE_SLABS", "VAR_OUTGOING_NUM_TCP",
-  "VAR_INFRA_HOST_TTL", "VAR_INFRA_LAME_TTL", "VAR_INFRA_CACHE_SLABS",
+  "COLON", "ANY", "ZONESTR", "STRING_ARG", "VAR_FORCE_TOPLEVEL",
+  "VAR_SERVER", "VAR_VERBOSITY", "VAR_NUM_THREADS", "VAR_PORT",
+  "VAR_OUTGOING_RANGE", "VAR_INTERFACE", "VAR_PREFER_IP4", "VAR_DO_IP4",
+  "VAR_DO_IP6", "VAR_PREFER_IP6", "VAR_DO_UDP", "VAR_DO_TCP",
+  "VAR_TCP_MSS", "VAR_OUTGOING_TCP_MSS", "VAR_TCP_IDLE_TIMEOUT",
+  "VAR_EDNS_TCP_KEEPALIVE", "VAR_EDNS_TCP_KEEPALIVE_TIMEOUT", "VAR_CHROOT",
+  "VAR_USERNAME", "VAR_DIRECTORY", "VAR_LOGFILE", "VAR_PIDFILE",
+  "VAR_MSG_CACHE_SIZE", "VAR_MSG_CACHE_SLABS",
+  "VAR_NUM_QUERIES_PER_THREAD", "VAR_RRSET_CACHE_SIZE",
+  "VAR_RRSET_CACHE_SLABS", "VAR_OUTGOING_NUM_TCP", "VAR_INFRA_HOST_TTL",
+  "VAR_INFRA_LAME_TTL", "VAR_INFRA_CACHE_SLABS",
   "VAR_INFRA_CACHE_NUMHOSTS", "VAR_INFRA_CACHE_LAME_SIZE", "VAR_NAME",
   "VAR_STUB_ZONE", "VAR_STUB_HOST", "VAR_STUB_ADDR",
   "VAR_TARGET_FETCH_POLICY", "VAR_HARDEN_SHORT_BUFSIZE",
@@ -1272,7 +1280,7 @@ static const char *const yytname[] =
   "VAR_DNSTAP_TLS_SERVER_NAME", "VAR_DNSTAP_TLS_CERT_BUNDLE",
   "VAR_DNSTAP_TLS_CLIENT_KEY_FILE", "VAR_DNSTAP_TLS_CLIENT_CERT_FILE",
   "VAR_DNSTAP_SEND_IDENTITY", "VAR_DNSTAP_SEND_VERSION",
-  "VAR_DNSTAP_IDENTITY", "VAR_DNSTAP_VERSION",
+  "VAR_DNSTAP_BIDIRECTIONAL", "VAR_DNSTAP_IDENTITY", "VAR_DNSTAP_VERSION",
   "VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES",
   "VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES",
   "VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES",
@@ -1325,17 +1333,17 @@ static const char *const yytname[] =
   "VAR_IPSET_NAME_V4", "VAR_IPSET_NAME_V6", "VAR_TLS_SESSION_TICKET_KEYS",
   "VAR_RPZ", "VAR_TAGS", "VAR_RPZ_ACTION_OVERRIDE",
   "VAR_RPZ_CNAME_OVERRIDE", "VAR_RPZ_LOG", "VAR_RPZ_LOG_NAME",
-  "VAR_DYNLIB", "VAR_DYNLIB_FILE", "$accept", "toplevelvars",
-  "toplevelvar", "serverstart", "contents_server", "content_server",
-  "stubstart", "contents_stub", "content_stub", "forwardstart",
-  "contents_forward", "content_forward", "viewstart", "contents_view",
-  "content_view", "authstart", "contents_auth", "content_auth", "rpz_tag",
-  "rpz_action_override", "rpz_cname_override", "rpz_log", "rpz_log_name",
-  "rpzstart", "contents_rpz", "content_rpz", "server_num_threads",
-  "server_verbosity", "server_statistics_interval",
-  "server_statistics_cumulative", "server_extended_statistics",
-  "server_shm_enable", "server_shm_key", "server_port",
-  "server_send_client_subnet", "server_client_subnet_zone",
+  "VAR_DYNLIB", "VAR_DYNLIB_FILE", "VAR_EDNS_CLIENT_TAG", "$accept",
+  "toplevelvars", "toplevelvar", "force_toplevel", "serverstart",
+  "contents_server", "content_server", "stubstart", "contents_stub",
+  "content_stub", "forwardstart", "contents_forward", "content_forward",
+  "viewstart", "contents_view", "content_view", "authstart",
+  "contents_auth", "content_auth", "rpz_tag", "rpz_action_override",
+  "rpz_cname_override", "rpz_log", "rpz_log_name", "rpzstart",
+  "contents_rpz", "content_rpz", "server_num_threads", "server_verbosity",
+  "server_statistics_interval", "server_statistics_cumulative",
+  "server_extended_statistics", "server_shm_enable", "server_shm_key",
+  "server_port", "server_send_client_subnet", "server_client_subnet_zone",
   "server_client_subnet_always_forward", "server_client_subnet_opcode",
   "server_max_client_subnet_ipv4", "server_max_client_subnet_ipv6",
   "server_min_client_subnet_ipv4", "server_min_client_subnet_ipv6",
@@ -1417,11 +1425,12 @@ static const char *const yytname[] =
   "server_qname_minimisation_strict", "server_ipsecmod_enabled",
   "server_ipsecmod_ignore_bogus", "server_ipsecmod_hook",
   "server_ipsecmod_max_ttl", "server_ipsecmod_whitelist",
-  "server_ipsecmod_strict", "stub_name", "stub_host", "stub_addr",
-  "stub_first", "stub_no_cache", "stub_ssl_upstream", "stub_prime",
-  "forward_name", "forward_host", "forward_addr", "forward_first",
-  "forward_no_cache", "forward_ssl_upstream", "auth_name", "auth_zonefile",
-  "auth_master", "auth_url", "auth_allow_notify", "auth_for_downstream",
+  "server_ipsecmod_strict", "server_edns_client_tag", "stub_name",
+  "stub_host", "stub_addr", "stub_first", "stub_no_cache",
+  "stub_ssl_upstream", "stub_prime", "forward_name", "forward_host",
+  "forward_addr", "forward_first", "forward_no_cache",
+  "forward_ssl_upstream", "auth_name", "auth_zonefile", "auth_master",
+  "auth_url", "auth_allow_notify", "auth_for_downstream",
   "auth_for_upstream", "auth_fallback_enabled", "view_name",
   "view_local_zone", "view_response_ip", "view_response_ip_data",
   "view_local_data", "view_local_data_ptr", "view_first", "rcstart",
@@ -1429,11 +1438,11 @@ static const char *const yytname[] =
   "rc_control_interface", "rc_control_use_cert", "rc_server_key_file",
   "rc_server_cert_file", "rc_control_key_file", "rc_control_cert_file",
   "dtstart", "contents_dt", "content_dt", "dt_dnstap_enable",
-  "dt_dnstap_socket_path", "dt_dnstap_ip", "dt_dnstap_tls",
-  "dt_dnstap_tls_server_name", "dt_dnstap_tls_cert_bundle",
-  "dt_dnstap_tls_client_key_file", "dt_dnstap_tls_client_cert_file",
-  "dt_dnstap_send_identity", "dt_dnstap_send_version",
-  "dt_dnstap_identity", "dt_dnstap_version",
+  "dt_dnstap_bidirectional", "dt_dnstap_socket_path", "dt_dnstap_ip",
+  "dt_dnstap_tls", "dt_dnstap_tls_server_name",
+  "dt_dnstap_tls_cert_bundle", "dt_dnstap_tls_client_key_file",
+  "dt_dnstap_tls_client_cert_file", "dt_dnstap_send_identity",
+  "dt_dnstap_send_version", "dt_dnstap_identity", "dt_dnstap_version",
   "dt_dnstap_log_resolver_query_messages",
   "dt_dnstap_log_resolver_response_messages",
   "dt_dnstap_log_client_query_messages",
@@ -1491,11 +1500,11 @@ static const yytype_int16 yytoknum[] =
      515,   516,   517,   518,   519,   520,   521,   522,   523,   524,
      525,   526,   527,   528,   529,   530,   531,   532,   533,   534,
      535,   536,   537,   538,   539,   540,   541,   542,   543,   544,
-     545,   546,   547,   548,   549,   550
+     545,   546,   547,   548,   549,   550,   551,   552,   553
 };
 # endif
 
-#define YYPACT_NINF (-286)
+#define YYPACT_NINF (-288)
 
 #define yypact_value_is_default(Yyn) \
   ((Yyn) == YYPACT_NINF)
@@ -1509,98 +1518,99 @@ static const yytype_int16 yytoknum[] =
      STATE-NUM.  */
 static const yytype_int16 yypact[] =
 {
-    -286,     0,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-     283,   -42,   -38,   -41,    -7,   -43,   -30,  -143,  -103,  -285,
-    -183,  -178,  -278,     2,     3,    24,    25,    26,    28,    31,
-      32,    33,    34,    36,    37,    38,    39,    40,    52,    53,
-      70,    71,    72,    73,    74,    75,    76,    77,    78,    79,
-      80,    81,    82,    83,    84,    87,    88,    90,    92,    93,
-      94,    96,    97,    98,    99,   100,   102,   103,   104,   105,
+    -288,     0,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,   284,   -42,   -38,   -43,   -21,   -44,   -11,   -93,
+    -109,  -287,  -212,  -237,  -279,     3,     4,    13,    25,    26,
+      27,    30,    31,    32,    33,    34,    35,    37,    38,    39,
+      40,    41,    43,    44,    45,    46,    47,    48,    49,    50,
+      51,    52,    54,    55,    84,    85,    88,    89,    91,    93,
+      94,    95,    97,    98,    99,   100,   101,   103,   104,   105,
      106,   107,   108,   109,   110,   111,   112,   113,   114,   115,
      116,   117,   118,   119,   120,   121,   122,   123,   124,   125,
      126,   129,   130,   131,   132,   133,   134,   135,   136,   137,
      138,   139,   140,   141,   142,   143,   144,   145,   146,   147,
-     149,   150,   151,   152,   153,   154,   155,   156,   157,   158,
+     148,   150,   151,   152,   153,   154,   155,   156,   157,   158,
      159,   160,   161,   162,   163,   164,   165,   166,   168,   169,
      170,   171,   172,   173,   174,   175,   176,   177,   178,   179,
      180,   181,   182,   183,   184,   185,   186,   187,   188,   189,
      190,   191,   192,   193,   194,   195,   196,   197,   198,   199,
-     200,   201,   202,   203,   204,   205,   207,   211,   212,   213,
-     214,   215,   216,   217,   219,   220,   221,   222,   225,   227,
-     228,   229,   230,   231,   232,   233,   234,   235,   243,   249,
-     251,   252,   253,   255,   256,   257,   258,   259,   260,   261,
+     200,   201,   202,   203,   204,   205,   206,   207,   212,   213,
+     214,   215,   216,   217,   218,   220,   221,   222,   223,   224,
+     227,   229,   231,   244,   245,   246,   247,   248,   249,   250,
+     251,   253,   254,   255,   256,   257,   258,   259,   260,   261,
      262,   263,   264,   265,   266,   267,   268,   269,   270,   271,
-     272,   273,   275,   276,   277,   279,   280,   281,   282,   317,
-     318,   319,   320,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,   324,   325,   326,   368,   369,   370,
-     371,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,   372,
-     373,   374,   375,   376,   380,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,   384,   385,   410,   411,   412,   420,   431,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,   432,   433,   434,
-     435,   436,   437,   438,   439,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,   440,   441,   442,   443,   444,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-     445,   446,   447,   448,   449,   489,   491,   507,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,   508,   509,   510,
-     511,   512,   513,   514,   515,   516,   517,   524,   525,   526,
-     527,   528,   529,   530,   532,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,   533,  -286,  -286,   534,  -286,  -286,
-     535,   536,   537,   538,   541,   544,   547,   548,   557,   558,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,   559,   561,   562,   563,   564,   565,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,   566,   567,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,   568,
-     569,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,   570,   571,   572,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,   573,   574,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,   575,   576,   577,   578,
-     579,   580,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,   581,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,   582,  -286,  -286,   583,   584,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,   585,   586,   587,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286
+     272,   273,   274,   275,   277,   278,   279,   281,   282,   283,
+     285,   319,   320,   321,   322,   326,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,   327,   328,
+     370,   371,   372,   373,   374,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,   375,   376,   377,   378,   382,   386,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,   387,   412,   413,   414,
+     422,   433,   434,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,   435,   436,   437,   438,   439,   440,   441,   442,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,   443,   444,
+     445,   446,   447,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,   448,   449,   450,   451,   452,   492,
+     494,   510,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,   511,   512,   513,   514,   515,   516,   517,   518,   519,
+     520,   527,   528,   529,   530,   531,   532,   533,   535,   536,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+     537,  -288,  -288,   538,  -288,  -288,   539,   540,   541,   544,
+     547,   550,   551,   560,   561,   562,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,   564,   565,   566,
+     567,   568,   569,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+     570,   571,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,   573,   574,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,   575,   576,
+     577,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,   578,   579,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,   580,   581,   582,   583,   584,   585,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,   586,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,   587,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+     588,  -288,  -288,   589,   590,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,   591,   592,   593,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288
 };
 
   /* YYDEFACT[STATE-NUM] -- Default reduction number in state STATE-NUM.
@@ -1608,11 +1618,11 @@ static const yytype_int16 yypact[] =
      means the default is an error.  */
 static const yytype_int16 yydefact[] =
 {
-       2,     0,     1,    17,   220,   230,   501,   559,   520,   239,
-     573,   596,   249,   612,   265,   564,     3,    19,   222,   232,
-     241,   251,   267,   503,   522,   561,   566,   575,   598,   614,
-       4,     5,     6,    10,    14,    15,     8,     9,     7,    16,
-      11,    12,    13,     0,     0,     0,     0,     0,     0,     0,
+       2,     0,     1,    18,    19,   223,   233,   505,   565,   524,
+     242,   579,   602,   252,   618,   268,   570,     3,    17,    21,
+     225,   235,   244,   254,   270,   507,   526,   567,   572,   581,
+     604,   620,     4,     5,     6,    10,    14,    15,     8,     9,
+       7,    16,    11,    12,    13,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
@@ -1632,150 +1642,151 @@ static const yytype_int16 yydefact[] =
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,    18,    20,    21,    84,    87,    96,   190,
-     191,    22,   155,   156,   157,   158,   159,   160,   161,   162,
-     163,   164,    35,    75,    23,    88,    89,    46,    68,    83,
-      24,    25,    28,    29,    26,    27,    30,    31,    32,    33,
-      34,   119,   202,   120,   122,   123,   124,   204,   209,   205,
-     216,   217,   218,   219,   125,   126,   127,   128,   129,   130,
-     186,    85,    74,   100,   117,   118,   214,   211,   121,    36,
-      37,    38,    39,    40,    76,    90,    91,   106,    62,    72,
-      63,   194,   195,   101,    56,    57,   193,    58,    59,   110,
-     114,   134,   143,   169,   146,   215,   111,    69,    41,    42,
-      43,    98,   135,   136,   137,    44,    45,    47,    48,    50,
-      51,    49,   141,    52,    53,    54,    60,    79,   115,    93,
-     142,    86,   165,    94,    95,   112,   113,   212,    99,    55,
-      77,    80,    61,    64,   102,   103,    78,   166,   104,    65,
-      66,    67,   203,   116,   179,   180,   181,   182,   183,   184,
-     192,   105,    73,   107,   108,   109,   167,    70,    71,    92,
-      81,    82,    97,   131,   132,   213,   133,   138,   139,   140,
-     170,   171,   173,   175,   176,   174,   177,   187,   144,   145,
-     149,   150,   147,   148,   151,   152,   154,   153,   206,   208,
-     207,   168,   178,   196,   198,   197,   199,   200,   201,   172,
-     185,   188,   189,   210,     0,     0,     0,     0,     0,     0,
-       0,   221,   223,   224,   225,   227,   228,   229,   226,     0,
-       0,     0,     0,     0,     0,   231,   233,   234,   235,   236,
-     237,   238,     0,     0,     0,     0,     0,     0,     0,   240,
-     242,   243,   246,   247,   244,   248,   245,     0,     0,     0,
-       0,     0,     0,     0,     0,   250,   252,   253,   254,   255,
-     259,   256,   257,   258,     0,     0,     0,     0,     0,   270,
-     274,   275,   276,   277,   266,   268,   269,   271,   272,   273,
-       0,     0,     0,     0,     0,     0,     0,     0,   502,   504,
-     506,   505,   511,   507,   508,   509,   510,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,    20,    22,    23,    86,
+      89,    98,   192,   193,    24,   157,   158,   159,   160,   161,
+     162,   163,   164,   165,   166,    37,    77,    25,    90,    91,
+      48,    70,    85,    26,    27,    30,    31,    28,    29,    32,
+      33,    34,    35,    36,   121,   204,   122,   124,   125,   126,
+     206,   211,   207,   218,   219,   220,   221,   127,   128,   129,
+     130,   131,   132,   188,    87,    76,   102,   119,   120,   216,
+     213,   123,    38,    39,    40,    41,    42,    78,    92,    93,
+     108,    64,    74,    65,   196,   197,   103,    58,    59,   195,
+      60,    61,   112,   116,   136,   145,   171,   148,   217,   113,
+      71,    43,    44,    45,   100,   137,   138,   139,    46,    47,
+      49,    50,    52,    53,    51,   143,    54,    55,    56,    62,
+      81,   117,    95,   144,    88,   167,    96,    97,   114,   115,
+     214,   101,    57,    79,    82,    63,    66,   104,   105,    80,
+     168,   106,    67,    68,    69,   205,   118,   181,   182,   183,
+     184,   185,   186,   194,   107,    75,   109,   110,   111,   169,
+      72,    73,    94,    83,    84,    99,   133,   134,   215,   135,
+     140,   141,   142,   172,   173,   175,   177,   178,   176,   179,
+     189,   146,   147,   151,   152,   149,   150,   153,   154,   156,
+     155,   208,   210,   209,   170,   180,   198,   200,   199,   201,
+     202,   203,   222,   174,   187,   190,   191,   212,     0,     0,
+       0,     0,     0,     0,     0,   224,   226,   227,   228,   230,
+     231,   232,   229,     0,     0,     0,     0,     0,     0,   234,
+     236,   237,   238,   239,   240,   241,     0,     0,     0,     0,
+       0,     0,     0,   243,   245,   246,   249,   250,   247,   251,
+     248,     0,     0,     0,     0,     0,     0,     0,     0,   253,
+     255,   256,   257,   258,   262,   259,   260,   261,     0,     0,
+       0,     0,     0,   273,   277,   278,   279,   280,   269,   271,
+     272,   274,   275,   276,     0,     0,     0,     0,     0,     0,
+       0,     0,   506,   508,   510,   509,   515,   511,   512,   513,
+     514,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,   521,   523,   524,   525,   526,
-     527,   528,   529,   530,   531,   532,   533,   534,   535,   536,
-     537,   538,   539,   540,     0,   560,   562,     0,   565,   567,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-     574,   576,   577,   578,   580,   581,   579,   582,   583,   584,
-     585,     0,     0,     0,     0,     0,     0,   597,   599,   600,
-     601,   602,   603,   604,     0,     0,   613,   615,   616,   279,
-     278,   285,   298,   296,   308,   304,   305,   309,   306,   307,
-     310,   311,   312,   313,   314,   343,   344,   345,   346,   347,
-     372,   373,   374,   379,   380,   301,   381,   382,   385,   383,
-     384,   387,   388,   389,   403,   358,   359,   361,   362,   390,
-     406,   352,   354,   407,   413,   414,   415,   302,   371,   431,
-     432,   353,   426,   336,   297,   348,   404,   410,   391,     0,
-       0,   435,   303,   280,   335,   395,   281,   299,   300,   349,
-     350,   433,   393,   397,   398,   282,   436,   375,   402,   337,
-     357,   408,   409,   412,   425,   351,   429,   427,   428,   363,
-     370,   399,   400,   364,   365,   392,   417,   338,   339,   342,
-     315,   317,   318,   319,   320,   321,   328,   329,   330,   331,
-     332,   333,   437,   438,   440,   376,   377,   378,   386,   441,
-     442,   443,     0,     0,     0,   394,   366,   368,   569,   452,
-     456,   454,   453,   457,   455,     0,     0,   460,   461,   286,
-     287,   288,   289,   290,   291,   292,   293,   294,   295,   396,
-     411,   430,   465,   466,   367,   444,     0,     0,     0,     0,
-       0,     0,   418,   419,   420,   421,   422,   423,   424,   570,
-     360,   355,   416,   334,   283,   284,   356,   467,   469,   468,
-     470,   471,   472,   316,   323,   462,   464,   463,   322,     0,
-     341,   401,   439,   340,   369,   324,   325,   327,   326,   473,
-     474,   475,   479,   478,   476,   477,   480,   481,   482,   483,
-     485,   484,   494,     0,   498,   499,     0,     0,   500,   486,
-     492,   487,   488,   489,   491,   493,   490,   260,   261,   262,
-     263,   264,   512,   514,   513,   516,   517,   518,   519,   515,
-     541,   542,   543,   544,   545,   546,   547,   548,   549,   550,
-     551,   552,   553,   554,   555,   556,   557,   558,   563,   568,
-     586,   587,   588,   591,   589,   590,   592,   593,   594,   595,
-     605,   606,   607,   608,   609,   610,   617,   618,   405,   434,
-     451,   571,   572,   458,   459,   445,   446,     0,     0,     0,
-     450,   611,   495,   496,   497,   449,   447,   448
+     525,   527,   529,   528,   530,   531,   532,   533,   534,   535,
+     536,   537,   538,   539,   540,   541,   542,   543,   544,   545,
+       0,   566,   568,     0,   571,   573,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,   580,   582,   583,   584,
+     586,   587,   585,   588,   589,   590,   591,     0,     0,     0,
+       0,     0,     0,   603,   605,   606,   607,   608,   609,   610,
+       0,     0,   619,   621,   622,   282,   281,   288,   301,   299,
+     311,   307,   308,   312,   309,   310,   313,   314,   315,   316,
+     317,   346,   347,   348,   349,   350,   375,   376,   377,   382,
+     383,   304,   384,   385,   388,   386,   387,   390,   391,   392,
+     406,   361,   362,   364,   365,   393,   409,   355,   357,   410,
+     416,   417,   418,   305,   374,   434,   435,   356,   429,   339,
+     300,   351,   407,   413,   394,     0,     0,   438,   306,   283,
+     338,   398,   284,   302,   303,   352,   353,   436,   396,   400,
+     401,   285,   439,   378,   405,   340,   360,   411,   412,   415,
+     428,   354,   432,   430,   431,   366,   373,   402,   403,   367,
+     368,   395,   420,   341,   342,   345,   318,   320,   321,   322,
+     323,   324,   331,   332,   333,   334,   335,   336,   440,   441,
+     443,   379,   380,   381,   389,   444,   445,   446,     0,     0,
+       0,   397,   369,   371,   575,   455,   459,   457,   456,   460,
+     458,     0,     0,   463,   464,   289,   290,   291,   292,   293,
+     294,   295,   296,   297,   298,   399,   414,   433,   468,   469,
+     370,   447,     0,     0,     0,     0,     0,     0,   421,   422,
+     423,   424,   425,   426,   427,   576,   363,   358,   419,   337,
+     286,   287,   359,   470,   472,   471,   473,   474,   475,   319,
+     326,   465,   467,   466,   325,     0,   344,   404,   442,   343,
+     372,   327,   328,   330,   329,     0,   477,   478,   479,   483,
+     482,   480,   481,   484,   485,   486,   487,   489,   488,   498,
+       0,   502,   503,     0,     0,   504,   490,   496,   491,   492,
+     493,   495,   497,   494,   263,   264,   265,   266,   267,   516,
+     518,   517,   520,   521,   522,   523,   519,   546,   548,   549,
+     550,   551,   552,   553,   554,   555,   556,   547,   557,   558,
+     559,   560,   561,   562,   563,   564,   569,   574,   592,   593,
+     594,   597,   595,   596,   598,   599,   600,   601,   611,   612,
+     613,   614,   615,   616,   623,   624,   408,   437,   454,   577,
+     578,   461,   462,   448,   449,     0,     0,     0,   453,   617,
+     476,   499,   500,   501,   452,   450,   451
 };
 
   /* YYPGOTO[NTERM-NUM].  */
 static const yytype_int16 yypgoto[] =
 {
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,   588,   589,   590,   591,   592,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,  -286,
-    -286
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,   572,   594,   595,   596,
+     597,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,  -288,
+    -288,  -288,  -288,  -288
 };
 
   /* YYDEFGOTO[NTERM-NUM].  */
 static const yytype_int16 yydefgoto[] =
 {
-      -1,     1,    16,    17,    30,   243,    18,    31,   451,    19,
-      32,   465,    20,    33,   479,    21,    34,   495,   509,   510,
-     511,   512,   513,    22,    35,   514,   244,   245,   246,   247,
-     248,   249,   250,   251,   252,   253,   254,   255,   256,   257,
-     258,   259,   260,   261,   262,   263,   264,   265,   266,   267,
-     268,   269,   270,   271,   272,   273,   274,   275,   276,   277,
-     278,   279,   280,   281,   282,   283,   284,   285,   286,   287,
-     288,   289,   290,   291,   292,   293,   294,   295,   296,   297,
-     298,   299,   300,   301,   302,   303,   304,   305,   306,   307,
-     308,   309,   310,   311,   312,   313,   314,   315,   316,   317,
-     318,   319,   320,   321,   322,   323,   324,   325,   326,   327,
-     328,   329,   330,   331,   332,   333,   334,   335,   336,   337,
-     338,   339,   340,   341,   342,   343,   344,   345,   346,   347,
-     348,   349,   350,   351,   352,   353,   354,   355,   356,   357,
-     358,   359,   360,   361,   362,   363,   364,   365,   366,   367,
-     368,   369,   370,   371,   372,   373,   374,   375,   376,   377,
-     378,   379,   380,   381,   382,   383,   384,   385,   386,   387,
-     388,   389,   390,   391,   392,   393,   394,   395,   396,   397,
-     398,   399,   400,   401,   402,   403,   404,   405,   406,   407,
-     408,   409,   410,   411,   412,   413,   414,   415,   416,   417,
-     418,   419,   420,   421,   422,   423,   424,   425,   426,   427,
-     428,   429,   430,   431,   432,   433,   434,   435,   436,   437,
-     438,   452,   453,   454,   455,   456,   457,   458,   466,   467,
-     468,   469,   470,   471,   496,   497,   498,   499,   500,   501,
-     502,   503,   480,   481,   482,   483,   484,   485,   486,    23,
-      36,   528,   529,   530,   531,   532,   533,   534,   535,   536,
-      24,    37,   555,   556,   557,   558,   559,   560,   561,   562,
-     563,   564,   565,   566,   567,   568,   569,   570,   571,   572,
-     573,    25,    38,   575,   576,    26,    39,   578,   579,   439,
-     440,   441,   442,    27,    40,   590,   591,   592,   593,   594,
-     595,   596,   597,   598,   599,   600,    28,    41,   607,   608,
-     609,   610,   611,   612,   613,   443,    29,    42,   616,   617,
-     618
+      -1,     1,    17,    18,    19,    32,   246,    20,    33,   455,
+      21,    34,   469,    22,    35,   483,    23,    36,   499,   513,
+     514,   515,   516,   517,    24,    37,   518,   247,   248,   249,
+     250,   251,   252,   253,   254,   255,   256,   257,   258,   259,
+     260,   261,   262,   263,   264,   265,   266,   267,   268,   269,
+     270,   271,   272,   273,   274,   275,   276,   277,   278,   279,
+     280,   281,   282,   283,   284,   285,   286,   287,   288,   289,
+     290,   291,   292,   293,   294,   295,   296,   297,   298,   299,
+     300,   301,   302,   303,   304,   305,   306,   307,   308,   309,
+     310,   311,   312,   313,   314,   315,   316,   317,   318,   319,
+     320,   321,   322,   323,   324,   325,   326,   327,   328,   329,
+     330,   331,   332,   333,   334,   335,   336,   337,   338,   339,
+     340,   341,   342,   343,   344,   345,   346,   347,   348,   349,
+     350,   351,   352,   353,   354,   355,   356,   357,   358,   359,
+     360,   361,   362,   363,   364,   365,   366,   367,   368,   369,
+     370,   371,   372,   373,   374,   375,   376,   377,   378,   379,
+     380,   381,   382,   383,   384,   385,   386,   387,   388,   389,
+     390,   391,   392,   393,   394,   395,   396,   397,   398,   399,
+     400,   401,   402,   403,   404,   405,   406,   407,   408,   409,
+     410,   411,   412,   413,   414,   415,   416,   417,   418,   419,
+     420,   421,   422,   423,   424,   425,   426,   427,   428,   429,
+     430,   431,   432,   433,   434,   435,   436,   437,   438,   439,
+     440,   441,   442,   456,   457,   458,   459,   460,   461,   462,
+     470,   471,   472,   473,   474,   475,   500,   501,   502,   503,
+     504,   505,   506,   507,   484,   485,   486,   487,   488,   489,
+     490,    25,    38,   532,   533,   534,   535,   536,   537,   538,
+     539,   540,    26,    39,   560,   561,   562,   563,   564,   565,
+     566,   567,   568,   569,   570,   571,   572,   573,   574,   575,
+     576,   577,   578,   579,    27,    40,   581,   582,    28,    41,
+     584,   585,   443,   444,   445,   446,    29,    42,   596,   597,
+     598,   599,   600,   601,   602,   603,   604,   605,   606,    30,
+      43,   613,   614,   615,   616,   617,   618,   619,   447,    31,
+      44,   622,   623,   624
 };
 
   /* YYTABLE[YYPACT[STATE-NUM]] -- What to do in state STATE-NUM.  If
@@ -1783,204 +1794,207 @@ static const yytype_int16 yydefgoto[] =
      number is the opposite.  If YYTABLE_NINF, syntax error.  */
 static const yytype_int16 yytable[] =
 {
-       2,   487,   444,   472,   445,   446,   459,   614,   615,   574,
-     577,     3,   619,   620,   460,   461,   537,   538,   539,   540,
-     541,   542,   543,   544,   545,   546,   547,   548,   549,   550,
-     551,   552,   553,   554,   621,   622,   623,   487,   624,   473,
-     474,   625,   626,   627,   628,     4,   629,   630,   631,   632,
-     633,     5,   580,   581,   582,   583,   584,   585,   586,   587,
-     588,   589,   634,   635,   475,   447,   520,   521,   522,   523,
-     524,   525,   526,   527,   601,   602,   603,   604,   605,   606,
-     636,   637,   638,   639,   640,   641,   642,   643,   644,   645,
-     646,   647,   648,   649,   650,     6,   448,   651,   652,   462,
-     653,   463,   654,   655,   656,   449,   657,   658,   659,   660,
-     661,     7,   662,   663,   664,   665,   666,   667,   668,   669,
-     670,   671,   672,   673,   674,   675,   676,   677,   678,   679,
-     680,   681,   682,   683,   684,   685,   686,   476,   477,   687,
-     688,   689,   690,   691,   692,   693,   694,   695,   696,   697,
-     698,   699,   700,   701,   702,   703,   704,   705,     8,   706,
-     707,   708,   709,   710,   711,   712,   713,   714,   715,   716,
-     717,   718,   719,   720,   721,   722,   723,   478,   724,   725,
-     726,   727,   728,   729,   730,   731,   732,   733,   734,   735,
-     736,   737,   738,   739,   740,   741,   742,   743,   744,   745,
-     746,   747,   748,   749,   750,   751,   752,   753,   754,   755,
-     756,   757,   758,   759,   760,   761,     9,   762,   489,   490,
-     491,   763,   764,   765,   766,   767,   768,   769,   494,   770,
-     771,   772,   773,   450,    10,   774,   464,   775,   776,   777,
-     778,   779,   780,   781,   782,   783,   504,   505,   506,   507,
-     508,    11,   488,   784,   489,   490,   491,   492,   493,   785,
-      12,   786,   787,   788,   494,   789,   790,   791,   792,   793,
-     794,   795,   796,   797,   798,   799,   800,   801,   802,   803,
-     804,   805,   806,   807,    13,   808,   809,   810,    14,   811,
-     812,   813,   814,     0,    15,    43,    44,    45,    46,    47,
+       2,   491,   476,   448,   580,   449,   450,   463,   620,   621,
+     583,     3,     4,   625,   626,   464,   465,   607,   608,   609,
+     610,   611,   612,   627,   491,   586,   587,   588,   589,   590,
+     591,   592,   593,   594,   595,   628,   629,   630,   477,   478,
+     631,   632,   633,   634,   635,   636,     5,   637,   638,   639,
+     640,   641,     6,   642,   643,   644,   645,   646,   647,   648,
+     649,   650,   651,   479,   652,   653,   451,   541,   542,   543,
+     544,   545,   546,   547,   548,   549,   550,   551,   552,   553,
+     554,   555,   556,   557,   558,   559,   524,   525,   526,   527,
+     528,   529,   530,   531,   654,   655,     7,   452,   656,   657,
+     466,   658,   467,   659,   660,   661,   453,   662,   663,   664,
+     665,   666,     8,   667,   668,   669,   670,   671,   672,   673,
+     674,   675,   676,   677,   678,   679,   680,   681,   682,   683,
+     684,   685,   686,   687,   688,   689,   690,   480,   481,   691,
+     692,   693,   694,   695,   696,   697,   698,   699,   700,   701,
+     702,   703,   704,   705,   706,   707,   708,   709,   710,     9,
+     711,   712,   713,   714,   715,   716,   717,   718,   719,   720,
+     721,   722,   723,   724,   725,   726,   727,   482,   728,   729,
+     730,   731,   732,   733,   734,   735,   736,   737,   738,   739,
+     740,   741,   742,   743,   744,   745,   746,   747,   748,   749,
+     750,   751,   752,   753,   754,   755,   756,   757,   758,   759,
+     760,   761,   762,   763,   764,   765,   766,   767,    10,   493,
+     494,   495,   768,   769,   770,   771,   772,   773,   774,   498,
+     775,   776,   777,   778,   779,   454,    11,   780,   468,   781,
+     492,   782,   493,   494,   495,   496,   497,   508,   509,   510,
+     511,   512,   498,    12,   783,   784,   785,   786,   787,   788,
+     789,   790,    13,   791,   792,   793,   794,   795,   796,   797,
+     798,   799,   800,   801,   802,   803,   804,   805,   806,   807,
+     808,   809,   810,   811,   812,   813,    14,   814,   815,   816,
+      15,   817,   818,   819,     0,   820,    16,    45,    46,    47,
       48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
       58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
-      68,    69,    70,    71,    72,    73,    74,   815,   816,   817,
-     818,    75,    76,    77,   819,   820,   821,    78,    79,    80,
+      68,    69,    70,    71,    72,    73,    74,    75,    76,   821,
+     822,   823,   824,    77,    78,    79,   825,   826,   827,    80,
       81,    82,    83,    84,    85,    86,    87,    88,    89,    90,
       91,    92,    93,    94,    95,    96,    97,    98,    99,   100,
      101,   102,   103,   104,   105,   106,   107,   108,   109,   110,
-     111,   112,   113,   114,   115,   116,   117,   118,   822,   823,
-     824,   825,   826,   827,   828,   829,   830,   119,   120,   121,
-     831,   122,   123,   124,   832,   833,   125,   126,   127,   128,
+     111,   112,   113,   114,   115,   116,   117,   118,   119,   120,
+     828,   829,   830,   831,   832,   833,   834,   835,   836,   121,
+     122,   123,   837,   124,   125,   126,   838,   839,   127,   128,
      129,   130,   131,   132,   133,   134,   135,   136,   137,   138,
      139,   140,   141,   142,   143,   144,   145,   146,   147,   148,
-     834,   835,   836,   149,   150,   151,   152,   153,   154,   155,
-     837,   156,   157,   158,   159,   160,   161,   162,   163,   164,
-     165,   838,   839,   840,   841,   842,   843,   844,   845,   846,
-     847,   848,   849,   850,   851,   852,   853,   854,   855,   856,
-     166,   167,   168,   169,   170,   171,   172,   173,   174,   175,
-     176,   177,   178,   179,   180,   181,   182,   183,   184,   185,
-     186,   187,   188,   189,   190,   191,   192,   193,   194,   195,
-     196,   197,   198,   199,   200,   201,   202,   203,   204,   857,
-     205,   858,   206,   207,   208,   209,   210,   211,   212,   213,
-     214,   215,   216,   217,   218,   219,   220,   859,   860,   861,
-     862,   863,   864,   865,   866,   867,   868,   869,   221,   222,
-     223,   224,   225,   226,   870,   871,   872,   873,   874,   875,
-     876,   227,   877,   878,   879,   880,   881,   882,   883,   228,
-     229,   884,   230,   231,   885,   232,   233,   886,   887,   234,
-     235,   236,   237,   238,   239,   240,   241,   888,   889,   890,
-     242,   891,   892,   893,   894,   895,   896,   897,   898,   899,
-     900,   901,   902,   903,   904,   905,   906,   907,   908,   909,
-     910,   911,   912,   913,   914,   915,   916,   917,     0,     0,
+     149,   150,   840,   841,   842,   151,   152,   153,   154,   155,
+     156,   157,   843,   158,   159,   160,   161,   162,   163,   164,
+     165,   166,   167,   844,   845,   846,   847,   848,   849,   850,
+     851,   852,   853,   854,   855,   856,   857,   858,   859,   860,
+     861,   862,   863,   168,   169,   170,   171,   172,   173,   174,
+     175,   176,   177,   178,   179,   180,   181,   182,   183,   184,
+     185,   186,   187,   188,   189,   190,   191,   192,   193,   194,
+     195,   196,   197,   198,   199,   200,   201,   202,   203,   204,
+     205,   206,   864,   207,   865,   208,   209,   210,   211,   212,
+     213,   214,   215,   216,   217,   218,   219,   220,   221,   222,
+     866,   867,   868,   869,   870,   871,   872,   873,   874,   875,
+     876,   223,   224,   225,   226,   227,   228,   877,   878,   879,
+     880,   881,   882,   883,   229,   884,   885,   886,   887,   888,
+     889,   890,   230,   231,   891,   232,   233,   892,   234,   235,
+     893,   894,   236,   237,   238,   239,   240,   241,   242,   243,
+     895,   896,   897,   244,   898,   899,   900,   901,   902,   903,
+     904,   905,   245,   906,   907,   908,   909,   910,   911,   912,
+     913,   914,   915,   916,   917,   918,   919,   920,   921,   922,
+     923,   924,   925,   926,     0,     0,     0,     0,     0,   519,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,   515,   516,   517,   518,   519
+       0,   520,   521,   522,   523
 };
 
 static const yytype_int16 yycheck[] =
 {
-       0,    44,    44,    44,    46,    47,    44,   285,   286,   112,
-     295,    11,    10,    10,    52,    53,   159,   160,   161,   162,
+       0,    45,    45,    45,   113,    47,    48,    45,   287,   288,
+     297,    11,    12,    10,    10,    53,    54,   254,   255,   256,
+     257,   258,   259,    10,    45,   237,   238,   239,   240,   241,
+     242,   243,   244,   245,   246,    10,    10,    10,    81,    82,
+      10,    10,    10,    10,    10,    10,    46,    10,    10,    10,
+      10,    10,    52,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,   106,    10,    10,   108,   160,   161,   162,
      163,   164,   165,   166,   167,   168,   169,   170,   171,   172,
-     173,   174,   175,   176,    10,    10,    10,    44,    10,    80,
-      81,    10,    10,    10,    10,    45,    10,    10,    10,    10,
-      10,    51,   235,   236,   237,   238,   239,   240,   241,   242,
-     243,   244,    10,    10,   105,   107,    96,    97,    98,    99,
-     100,   101,   102,   103,   252,   253,   254,   255,   256,   257,
+     173,   174,   175,   176,   177,   178,    97,    98,    99,   100,
+     101,   102,   103,   104,    10,    10,    96,   139,    10,    10,
+     138,    10,   140,    10,    10,    10,   148,    10,    10,    10,
+      10,    10,   112,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    95,   138,    10,    10,   137,
-      10,   139,    10,    10,    10,   147,    10,    10,    10,    10,
-      10,   111,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,    10,    10,   180,   181,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,   178,   179,    10,
+      10,    10,    10,    10,    10,    10,    10,    10,    10,   159,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,   158,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,   218,    10,    10,
+      10,    10,    10,    10,    10,    10,    10,   220,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,   216,    10,   261,   262,
-     263,    10,    10,    10,    10,    10,    10,    10,   271,    10,
-      10,    10,    10,   275,   234,    10,   274,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,   289,   290,   291,   292,
-     293,   251,   259,    10,   261,   262,   263,   264,   265,    10,
-     260,    10,    10,    10,   271,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,    10,    10,    10,   218,   263,
+     264,   265,    10,    10,    10,    10,    10,    10,    10,   273,
+      10,    10,    10,    10,    10,   277,   236,    10,   276,    10,
+     261,    10,   263,   264,   265,   266,   267,   291,   292,   293,
+     294,   295,   273,   253,    10,    10,    10,    10,    10,    10,
+      10,    10,   262,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,   284,    10,    10,    10,   288,    10,
-      10,    10,    10,    -1,   294,    12,    13,    14,    15,    16,
-      17,    18,    19,    20,    21,    22,    23,    24,    25,    26,
-      27,    28,    29,    30,    31,    32,    33,    34,    35,    36,
-      37,    38,    39,    40,    41,    42,    43,    10,    10,    10,
-      10,    48,    49,    50,    10,    10,    10,    54,    55,    56,
-      57,    58,    59,    60,    61,    62,    63,    64,    65,    66,
-      67,    68,    69,    70,    71,    72,    73,    74,    75,    76,
-      77,    78,    79,    80,    81,    82,    83,    84,    85,    86,
-      87,    88,    89,    90,    91,    92,    93,    94,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,   104,   105,   106,
-      10,   108,   109,   110,    10,    10,   113,   114,   115,   116,
-     117,   118,   119,   120,   121,   122,   123,   124,   125,   126,
-     127,   128,   129,   130,   131,   132,   133,   134,   135,   136,
-      10,    10,    10,   140,   141,   142,   143,   144,   145,   146,
-      10,   148,   149,   150,   151,   152,   153,   154,   155,   156,
-     157,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,    10,   286,    10,    10,    10,
+     290,    10,    10,    10,    -1,    10,   296,    13,    14,    15,
+      16,    17,    18,    19,    20,    21,    22,    23,    24,    25,
+      26,    27,    28,    29,    30,    31,    32,    33,    34,    35,
+      36,    37,    38,    39,    40,    41,    42,    43,    44,    10,
+      10,    10,    10,    49,    50,    51,    10,    10,    10,    55,
+      56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
+      66,    67,    68,    69,    70,    71,    72,    73,    74,    75,
+      76,    77,    78,    79,    80,    81,    82,    83,    84,    85,
+      86,    87,    88,    89,    90,    91,    92,    93,    94,    95,
+      10,    10,    10,    10,    10,    10,    10,    10,    10,   105,
+     106,   107,    10,   109,   110,   111,    10,    10,   114,   115,
+     116,   117,   118,   119,   120,   121,   122,   123,   124,   125,
+     126,   127,   128,   129,   130,   131,   132,   133,   134,   135,
+     136,   137,    10,    10,    10,   141,   142,   143,   144,   145,
+     146,   147,    10,   149,   150,   151,   152,   153,   154,   155,
+     156,   157,   158,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-     177,   178,   179,   180,   181,   182,   183,   184,   185,   186,
-     187,   188,   189,   190,   191,   192,   193,   194,   195,   196,
-     197,   198,   199,   200,   201,   202,   203,   204,   205,   206,
-     207,   208,   209,   210,   211,   212,   213,   214,   215,    10,
-     217,    10,   219,   220,   221,   222,   223,   224,   225,   226,
-     227,   228,   229,   230,   231,   232,   233,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,   245,   246,
-     247,   248,   249,   250,    10,    10,    10,    10,    10,    10,
-      10,   258,    10,    10,    10,    10,    10,    10,    10,   266,
-     267,    10,   269,   270,    10,   272,   273,    10,    10,   276,
-     277,   278,   279,   280,   281,   282,   283,    10,    10,    10,
-     287,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,   179,   180,   181,   182,   183,   184,   185,
+     186,   187,   188,   189,   190,   191,   192,   193,   194,   195,
+     196,   197,   198,   199,   200,   201,   202,   203,   204,   205,
+     206,   207,   208,   209,   210,   211,   212,   213,   214,   215,
+     216,   217,    10,   219,    10,   221,   222,   223,   224,   225,
+     226,   227,   228,   229,   230,   231,   232,   233,   234,   235,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,    10,    -1,    -1,
+      10,   247,   248,   249,   250,   251,   252,    10,    10,    10,
+      10,    10,    10,    10,   260,    10,    10,    10,    10,    10,
+      10,    10,   268,   269,    10,   271,   272,    10,   274,   275,
+      10,    10,   278,   279,   280,   281,   282,   283,   284,   285,
+      10,    10,    10,   289,    10,    10,    10,    10,    10,    10,
+      10,    10,   298,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
+      10,    10,    10,    10,    -1,    -1,    -1,    -1,    -1,    37,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    35,    35,    35,    35,    35
+      -1,    37,    37,    37,    37
 };
 
   /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
      symbol of state STATE-NUM.  */
 static const yytype_int16 yystos[] =
 {
-       0,   297,     0,    11,    45,    51,    95,   111,   158,   216,
-     234,   251,   260,   284,   288,   294,   298,   299,   302,   305,
-     308,   311,   319,   545,   556,   577,   581,   589,   602,   612,
-     300,   303,   306,   309,   312,   320,   546,   557,   578,   582,
-     590,   603,   613,    12,    13,    14,    15,    16,    17,    18,
-      19,    20,    21,    22,    23,    24,    25,    26,    27,    28,
-      29,    30,    31,    32,    33,    34,    35,    36,    37,    38,
-      39,    40,    41,    42,    43,    48,    49,    50,    54,    55,
-      56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
-      66,    67,    68,    69,    70,    71,    72,    73,    74,    75,
-      76,    77,    78,    79,    80,    81,    82,    83,    84,    85,
-      86,    87,    88,    89,    90,    91,    92,    93,    94,   104,
-     105,   106,   108,   109,   110,   113,   114,   115,   116,   117,
-     118,   119,   120,   121,   122,   123,   124,   125,   126,   127,
-     128,   129,   130,   131,   132,   133,   134,   135,   136,   140,
-     141,   142,   143,   144,   145,   146,   148,   149,   150,   151,
-     152,   153,   154,   155,   156,   157,   177,   178,   179,   180,
+       0,   300,     0,    11,    12,    46,    52,    96,   112,   159,
+     218,   236,   253,   262,   286,   290,   296,   301,   302,   303,
+     306,   309,   312,   315,   323,   550,   561,   583,   587,   595,
+     608,   618,   304,   307,   310,   313,   316,   324,   551,   562,
+     584,   588,   596,   609,   619,    13,    14,    15,    16,    17,
+      18,    19,    20,    21,    22,    23,    24,    25,    26,    27,
+      28,    29,    30,    31,    32,    33,    34,    35,    36,    37,
+      38,    39,    40,    41,    42,    43,    44,    49,    50,    51,
+      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
+      65,    66,    67,    68,    69,    70,    71,    72,    73,    74,
+      75,    76,    77,    78,    79,    80,    81,    82,    83,    84,
+      85,    86,    87,    88,    89,    90,    91,    92,    93,    94,
+      95,   105,   106,   107,   109,   110,   111,   114,   115,   116,
+     117,   118,   119,   120,   121,   122,   123,   124,   125,   126,
+     127,   128,   129,   130,   131,   132,   133,   134,   135,   136,
+     137,   141,   142,   143,   144,   145,   146,   147,   149,   150,
+     151,   152,   153,   154,   155,   156,   157,   158,   179,   180,
      181,   182,   183,   184,   185,   186,   187,   188,   189,   190,
      191,   192,   193,   194,   195,   196,   197,   198,   199,   200,
      201,   202,   203,   204,   205,   206,   207,   208,   209,   210,
-     211,   212,   213,   214,   215,   217,   219,   220,   221,   222,
+     211,   212,   213,   214,   215,   216,   217,   219,   221,   222,
      223,   224,   225,   226,   227,   228,   229,   230,   231,   232,
-     233,   245,   246,   247,   248,   249,   250,   258,   266,   267,
-     269,   270,   272,   273,   276,   277,   278,   279,   280,   281,
-     282,   283,   287,   301,   322,   323,   324,   325,   326,   327,
-     328,   329,   330,   331,   332,   333,   334,   335,   336,   337,
-     338,   339,   340,   341,   342,   343,   344,   345,   346,   347,
-     348,   349,   350,   351,   352,   353,   354,   355,   356,   357,
-     358,   359,   360,   361,   362,   363,   364,   365,   366,   367,
-     368,   369,   370,   371,   372,   373,   374,   375,   376,   377,
-     378,   379,   380,   381,   382,   383,   384,   385,   386,   387,
-     388,   389,   390,   391,   392,   393,   394,   395,   396,   397,
-     398,   399,   400,   401,   402,   403,   404,   405,   406,   407,
-     408,   409,   410,   411,   412,   413,   414,   415,   416,   417,
-     418,   419,   420,   421,   422,   423,   424,   425,   426,   427,
-     428,   429,   430,   431,   432,   433,   434,   435,   436,   437,
-     438,   439,   440,   441,   442,   443,   444,   445,   446,   447,
-     448,   449,   450,   451,   452,   453,   454,   455,   456,   457,
-     458,   459,   460,   461,   462,   463,   464,   465,   466,   467,
-     468,   469,   470,   471,   472,   473,   474,   475,   476,   477,
-     478,   479,   480,   481,   482,   483,   484,   485,   486,   487,
-     488,   489,   490,   491,   492,   493,   494,   495,   496,   497,
-     498,   499,   500,   501,   502,   503,   504,   505,   506,   507,
-     508,   509,   510,   511,   512,   513,   514,   515,   516,   585,
-     586,   587,   588,   611,    44,    46,    47,   107,   138,   147,
-     275,   304,   517,   518,   519,   520,   521,   522,   523,    44,
-      52,    53,   137,   139,   274,   307,   524,   525,   526,   527,
-     528,   529,    44,    80,    81,   105,   178,   179,   218,   310,
-     538,   539,   540,   541,   542,   543,   544,    44,   259,   261,
-     262,   263,   264,   265,   271,   313,   530,   531,   532,   533,
-     534,   535,   536,   537,   289,   290,   291,   292,   293,   314,
-     315,   316,   317,   318,   321,   530,   531,   532,   533,   534,
-      96,    97,    98,    99,   100,   101,   102,   103,   547,   548,
-     549,   550,   551,   552,   553,   554,   555,   159,   160,   161,
-     162,   163,   164,   165,   166,   167,   168,   169,   170,   171,
-     172,   173,   174,   175,   176,   558,   559,   560,   561,   562,
+     233,   234,   235,   247,   248,   249,   250,   251,   252,   260,
+     268,   269,   271,   272,   274,   275,   278,   279,   280,   281,
+     282,   283,   284,   285,   289,   298,   305,   326,   327,   328,
+     329,   330,   331,   332,   333,   334,   335,   336,   337,   338,
+     339,   340,   341,   342,   343,   344,   345,   346,   347,   348,
+     349,   350,   351,   352,   353,   354,   355,   356,   357,   358,
+     359,   360,   361,   362,   363,   364,   365,   366,   367,   368,
+     369,   370,   371,   372,   373,   374,   375,   376,   377,   378,
+     379,   380,   381,   382,   383,   384,   385,   386,   387,   388,
+     389,   390,   391,   392,   393,   394,   395,   396,   397,   398,
+     399,   400,   401,   402,   403,   404,   405,   406,   407,   408,
+     409,   410,   411,   412,   413,   414,   415,   416,   417,   418,
+     419,   420,   421,   422,   423,   424,   425,   426,   427,   428,
+     429,   430,   431,   432,   433,   434,   435,   436,   437,   438,
+     439,   440,   441,   442,   443,   444,   445,   446,   447,   448,
+     449,   450,   451,   452,   453,   454,   455,   456,   457,   458,
+     459,   460,   461,   462,   463,   464,   465,   466,   467,   468,
+     469,   470,   471,   472,   473,   474,   475,   476,   477,   478,
+     479,   480,   481,   482,   483,   484,   485,   486,   487,   488,
+     489,   490,   491,   492,   493,   494,   495,   496,   497,   498,
+     499,   500,   501,   502,   503,   504,   505,   506,   507,   508,
+     509,   510,   511,   512,   513,   514,   515,   516,   517,   518,
+     519,   520,   521,   591,   592,   593,   594,   617,    45,    47,
+      48,   108,   139,   148,   277,   308,   522,   523,   524,   525,
+     526,   527,   528,    45,    53,    54,   138,   140,   276,   311,
+     529,   530,   531,   532,   533,   534,    45,    81,    82,   106,
+     180,   181,   220,   314,   543,   544,   545,   546,   547,   548,
+     549,    45,   261,   263,   264,   265,   266,   267,   273,   317,
+     535,   536,   537,   538,   539,   540,   541,   542,   291,   292,
+     293,   294,   295,   318,   319,   320,   321,   322,   325,   535,
+     536,   537,   538,   539,    97,    98,    99,   100,   101,   102,
+     103,   104,   552,   553,   554,   555,   556,   557,   558,   559,
+     560,   160,   161,   162,   163,   164,   165,   166,   167,   168,
+     169,   170,   171,   172,   173,   174,   175,   176,   177,   178,
      563,   564,   565,   566,   567,   568,   569,   570,   571,   572,
-     573,   574,   575,   576,   112,   579,   580,   295,   583,   584,
-     235,   236,   237,   238,   239,   240,   241,   242,   243,   244,
-     591,   592,   593,   594,   595,   596,   597,   598,   599,   600,
-     601,   252,   253,   254,   255,   256,   257,   604,   605,   606,
-     607,   608,   609,   610,   285,   286,   614,   615,   616,    10,
+     573,   574,   575,   576,   577,   578,   579,   580,   581,   582,
+     113,   585,   586,   297,   589,   590,   237,   238,   239,   240,
+     241,   242,   243,   244,   245,   246,   597,   598,   599,   600,
+     601,   602,   603,   604,   605,   606,   607,   254,   255,   256,
+     257,   258,   259,   610,   611,   612,   613,   614,   615,   616,
+     287,   288,   620,   621,   622,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
@@ -2010,141 +2024,143 @@ static const yytype_int16 yystos[] =
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
       10,    10,    10,    10,    10,    10,    10,    10,    10,    10,
-      10,    10,    10,    10,    10,    10,    10,    10
+      10,    10,    10,    10,    10,    10,    10
 };
 
   /* YYR1[YYN] -- Symbol number of symbol that rule YYN derives.  */
 static const yytype_int16 yyr1[] =
 {
-       0,   296,   297,   297,   298,   298,   298,   298,   298,   298,
-     298,   298,   298,   298,   298,   298,   298,   299,   300,   300,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     301,   301,   301,   301,   301,   301,   301,   301,   301,   301,
-     302,   303,   303,   304,   304,   304,   304,   304,   304,   304,
-     305,   306,   306,   307,   307,   307,   307,   307,   307,   308,
-     309,   309,   310,   310,   310,   310,   310,   310,   310,   311,
-     312,   312,   313,   313,   313,   313,   313,   313,   313,   313,
-     314,   315,   316,   317,   318,   319,   320,   320,   321,   321,
-     321,   321,   321,   321,   321,   321,   321,   321,   322,   323,
-     324,   325,   326,   327,   328,   329,   330,   331,   332,   333,
-     334,   335,   336,   337,   338,   339,   340,   341,   342,   343,
-     344,   345,   346,   347,   348,   349,   350,   351,   352,   353,
-     354,   355,   356,   357,   358,   359,   360,   361,   362,   363,
-     364,   365,   366,   367,   368,   369,   370,   371,   372,   373,
-     374,   375,   376,   377,   378,   379,   380,   381,   382,   383,
-     384,   385,   386,   387,   388,   389,   390,   391,   392,   393,
-     394,   395,   396,   397,   398,   399,   400,   401,   402,   403,
-     404,   405,   406,   407,   408,   409,   410,   411,   412,   413,
-     414,   415,   416,   417,   418,   419,   420,   421,   422,   423,
-     424,   425,   426,   427,   428,   429,   430,   431,   432,   433,
-     434,   435,   436,   437,   438,   439,   440,   441,   442,   443,
-     444,   445,   446,   447,   448,   449,   450,   451,   452,   453,
-     454,   455,   456,   457,   458,   459,   460,   461,   462,   463,
-     464,   465,   466,   467,   468,   469,   470,   471,   472,   473,
-     474,   475,   476,   477,   478,   479,   480,   481,   482,   483,
-     484,   485,   486,   487,   488,   489,   490,   491,   492,   493,
-     494,   495,   496,   497,   498,   499,   500,   501,   502,   503,
-     504,   505,   506,   507,   508,   509,   510,   511,   512,   513,
-     514,   515,   516,   517,   518,   519,   520,   521,   522,   523,
-     524,   525,   526,   527,   528,   529,   530,   531,   532,   533,
-     534,   535,   536,   537,   538,   539,   540,   541,   542,   543,
-     544,   545,   546,   546,   547,   547,   547,   547,   547,   547,
-     547,   547,   548,   549,   550,   551,   552,   553,   554,   555,
-     556,   557,   557,   558,   558,   558,   558,   558,   558,   558,
-     558,   558,   558,   558,   558,   558,   558,   558,   558,   558,
-     558,   559,   560,   561,   562,   563,   564,   565,   566,   567,
+       0,   299,   300,   300,   301,   301,   301,   301,   301,   301,
+     301,   301,   301,   301,   301,   301,   301,   301,   302,   303,
+     304,   304,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   305,   305,   305,   305,   305,   305,   305,
+     305,   305,   305,   306,   307,   307,   308,   308,   308,   308,
+     308,   308,   308,   309,   310,   310,   311,   311,   311,   311,
+     311,   311,   312,   313,   313,   314,   314,   314,   314,   314,
+     314,   314,   315,   316,   316,   317,   317,   317,   317,   317,
+     317,   317,   317,   318,   319,   320,   321,   322,   323,   324,
+     324,   325,   325,   325,   325,   325,   325,   325,   325,   325,
+     325,   326,   327,   328,   329,   330,   331,   332,   333,   334,
+     335,   336,   337,   338,   339,   340,   341,   342,   343,   344,
+     345,   346,   347,   348,   349,   350,   351,   352,   353,   354,
+     355,   356,   357,   358,   359,   360,   361,   362,   363,   364,
+     365,   366,   367,   368,   369,   370,   371,   372,   373,   374,
+     375,   376,   377,   378,   379,   380,   381,   382,   383,   384,
+     385,   386,   387,   388,   389,   390,   391,   392,   393,   394,
+     395,   396,   397,   398,   399,   400,   401,   402,   403,   404,
+     405,   406,   407,   408,   409,   410,   411,   412,   413,   414,
+     415,   416,   417,   418,   419,   420,   421,   422,   423,   424,
+     425,   426,   427,   428,   429,   430,   431,   432,   433,   434,
+     435,   436,   437,   438,   439,   440,   441,   442,   443,   444,
+     445,   446,   447,   448,   449,   450,   451,   452,   453,   454,
+     455,   456,   457,   458,   459,   460,   461,   462,   463,   464,
+     465,   466,   467,   468,   469,   470,   471,   472,   473,   474,
+     475,   476,   477,   478,   479,   480,   481,   482,   483,   484,
+     485,   486,   487,   488,   489,   490,   491,   492,   493,   494,
+     495,   496,   497,   498,   499,   500,   501,   502,   503,   504,
+     505,   506,   507,   508,   509,   510,   511,   512,   513,   514,
+     515,   516,   517,   518,   519,   520,   521,   522,   523,   524,
+     525,   526,   527,   528,   529,   530,   531,   532,   533,   534,
+     535,   536,   537,   538,   539,   540,   541,   542,   543,   544,
+     545,   546,   547,   548,   549,   550,   551,   551,   552,   552,
+     552,   552,   552,   552,   552,   552,   553,   554,   555,   556,
+     557,   558,   559,   560,   561,   562,   562,   563,   563,   563,
+     563,   563,   563,   563,   563,   563,   563,   563,   563,   563,
+     563,   563,   563,   563,   563,   563,   564,   565,   566,   567,
      568,   569,   570,   571,   572,   573,   574,   575,   576,   577,
-     578,   578,   579,   580,   581,   582,   582,   583,   584,   585,
-     586,   587,   588,   589,   590,   590,   591,   591,   591,   591,
-     591,   591,   591,   591,   591,   591,   592,   593,   594,   595,
-     596,   597,   598,   599,   600,   601,   602,   603,   603,   604,
-     604,   604,   604,   604,   604,   605,   606,   607,   608,   609,
-     610,   611,   612,   613,   613,   614,   614,   615,   616
+     578,   579,   580,   581,   582,   583,   584,   584,   585,   586,
+     587,   588,   588,   589,   590,   591,   592,   593,   594,   595,
+     596,   596,   597,   597,   597,   597,   597,   597,   597,   597,
+     597,   597,   598,   599,   600,   601,   602,   603,   604,   605,
+     606,   607,   608,   609,   609,   610,   610,   610,   610,   610,
+     610,   611,   612,   613,   614,   615,   616,   617,   618,   619,
+     619,   620,   620,   621,   622
 };
 
   /* YYR2[YYN] -- Number of symbols on the right hand side of rule YYN.  */
 static const yytype_int8 yyr2[] =
 {
        0,     2,     0,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     1,     2,     0,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     2,     0,     1,     1,     1,     1,     1,     1,     1,
-       1,     2,     0,     1,     1,     1,     1,     1,     1,     1,
+       2,     2,     2,     2,     2,     2,     2,     1,     1,     1,
        2,     0,     1,     1,     1,     1,     1,     1,     1,     1,
-       2,     0,     1,     1,     1,     1,     1,     1,     1,     1,
-       2,     2,     2,     2,     2,     1,     2,     0,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     3,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     3,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     3,     3,     4,     4,     4,
-       3,     3,     2,     2,     2,     2,     2,     2,     3,     3,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     3,     3,     3,     2,     2,
-       2,     1,     2,     0,     1,     1,     1,     1,     1,     1,
-       1,     1,     2,     2,     2,     2,     2,     2,     2,     2,
-       1,     2,     0,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     2,     0,     1,     1,     1,     1,
+       1,     1,     1,     1,     2,     0,     1,     1,     1,     1,
+       1,     1,     1,     2,     0,     1,     1,     1,     1,     1,
+       1,     1,     1,     2,     0,     1,     1,     1,     1,     1,
+       1,     1,     1,     2,     2,     2,     2,     2,     1,     2,
+       0,     1,     1,     1,     1,     1,     1,     1,     1,     1,
        1,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     1,
-       2,     0,     1,     2,     1,     2,     0,     1,     2,     2,
-       2,     3,     3,     1,     2,     0,     1,     1,     1,     1,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     3,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     3,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     3,     3,
+       4,     4,     4,     3,     3,     2,     2,     2,     2,     2,
+       2,     3,     3,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     3,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     3,
+       3,     3,     2,     2,     2,     1,     2,     0,     1,     1,
        1,     1,     1,     1,     1,     1,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     1,     2,     0,     1,
-       1,     1,     1,     1,     1,     2,     2,     2,     2,     2,
-       2,     3,     1,     2,     0,     1,     1,     2,     2
+       2,     2,     2,     2,     1,     2,     0,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,     1,     2,     0,     1,     2,
+       1,     2,     0,     1,     2,     2,     2,     3,     3,     1,
+       2,     0,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     2,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     1,     2,     0,     1,     1,     1,     1,     1,
+       1,     2,     2,     2,     2,     2,     2,     3,     1,     2,
+       0,     1,     1,     2,     2
 };
 
 
@@ -2839,16 +2855,24 @@ yyreduce:
   YY_REDUCE_PRINT (yyn);
   switch (yyn)
     {
-  case 17:
+  case 18:
 #line 194 "./util/configparser.y"
-        { 
-		OUTYY(("\nP(server:)\n")); 
+        {
+		OUTYY(("\nP(force-toplevel)\n"));
 	}
-#line 2848 "util/configparser.c"
+#line 2864 "util/configparser.c"
     break;
 
-  case 220:
-#line 291 "./util/configparser.y"
+  case 19:
+#line 200 "./util/configparser.y"
+        { 
+		OUTYY(("\nP(server:)\n"));
+	}
+#line 2872 "util/configparser.c"
+    break;
+
+  case 223:
+#line 297 "./util/configparser.y"
         {
 		struct config_stub* s;
 		OUTYY(("\nP(stub_zone:)\n")); 
@@ -2859,11 +2883,11 @@ yyreduce:
 		} else 
 			yyerror("out of memory");
 	}
-#line 2863 "util/configparser.c"
+#line 2887 "util/configparser.c"
     break;
 
-  case 230:
-#line 308 "./util/configparser.y"
+  case 233:
+#line 314 "./util/configparser.y"
         {
 		struct config_stub* s;
 		OUTYY(("\nP(forward_zone:)\n")); 
@@ -2874,11 +2898,11 @@ yyreduce:
 		} else 
 			yyerror("out of memory");
 	}
-#line 2878 "util/configparser.c"
+#line 2902 "util/configparser.c"
     break;
 
-  case 239:
-#line 325 "./util/configparser.y"
+  case 242:
+#line 331 "./util/configparser.y"
         {
 		struct config_view* s;
 		OUTYY(("\nP(view:)\n")); 
@@ -2891,11 +2915,11 @@ yyreduce:
 		} else 
 			yyerror("out of memory");
 	}
-#line 2895 "util/configparser.c"
+#line 2919 "util/configparser.c"
     break;
 
-  case 249:
-#line 344 "./util/configparser.y"
+  case 252:
+#line 350 "./util/configparser.y"
         {
 		struct config_auth* s;
 		OUTYY(("\nP(auth_zone:)\n")); 
@@ -2911,11 +2935,11 @@ yyreduce:
 		} else 
 			yyerror("out of memory");
 	}
-#line 2915 "util/configparser.c"
+#line 2939 "util/configparser.c"
     break;
 
-  case 260:
-#line 368 "./util/configparser.y"
+  case 263:
+#line 374 "./util/configparser.y"
         {
 		uint8_t* bitlist;
 		size_t len = 0;
@@ -2932,11 +2956,11 @@ yyreduce:
 
 		}
 	}
-#line 2936 "util/configparser.c"
+#line 2960 "util/configparser.c"
     break;
 
-  case 261:
-#line 387 "./util/configparser.y"
+  case 264:
+#line 393 "./util/configparser.y"
         {
 		OUTYY(("P(rpz_action_override:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "nxdomain")!=0 && strcmp((yyvsp[0].str), "nodata")!=0 &&
@@ -2951,21 +2975,21 @@ yyreduce:
 			cfg_parser->cfg->auths->rpz_action_override = (yyvsp[0].str);
 		}
 	}
-#line 2955 "util/configparser.c"
+#line 2979 "util/configparser.c"
     break;
 
-  case 262:
-#line 404 "./util/configparser.y"
+  case 265:
+#line 410 "./util/configparser.y"
         {
 		OUTYY(("P(rpz_cname_override:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->auths->rpz_cname);
 		cfg_parser->cfg->auths->rpz_cname = (yyvsp[0].str);
 	}
-#line 2965 "util/configparser.c"
+#line 2989 "util/configparser.c"
     break;
 
-  case 263:
-#line 412 "./util/configparser.y"
+  case 266:
+#line 418 "./util/configparser.y"
         {
 		OUTYY(("P(rpz_log:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -2973,21 +2997,21 @@ yyreduce:
 		else cfg_parser->cfg->auths->rpz_log = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 2977 "util/configparser.c"
+#line 3001 "util/configparser.c"
     break;
 
-  case 264:
-#line 422 "./util/configparser.y"
+  case 267:
+#line 428 "./util/configparser.y"
         {
 		OUTYY(("P(rpz_log_name:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->auths->rpz_log_name);
 		cfg_parser->cfg->auths->rpz_log_name = (yyvsp[0].str);
 	}
-#line 2987 "util/configparser.c"
+#line 3011 "util/configparser.c"
     break;
 
-  case 265:
-#line 430 "./util/configparser.y"
+  case 268:
+#line 436 "./util/configparser.y"
         {
 		struct config_auth* s;
 		OUTYY(("\nP(rpz:)\n")); 
@@ -3003,11 +3027,11 @@ yyreduce:
 		} else 
 			yyerror("out of memory");
 	}
-#line 3007 "util/configparser.c"
+#line 3031 "util/configparser.c"
     break;
 
-  case 278:
-#line 453 "./util/configparser.y"
+  case 281:
+#line 459 "./util/configparser.y"
         { 
 		OUTYY(("P(server_num_threads:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3015,11 +3039,11 @@ yyreduce:
 		else cfg_parser->cfg->num_threads = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3019 "util/configparser.c"
+#line 3043 "util/configparser.c"
     break;
 
-  case 279:
-#line 462 "./util/configparser.y"
+  case 282:
+#line 468 "./util/configparser.y"
         { 
 		OUTYY(("P(server_verbosity:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3027,11 +3051,11 @@ yyreduce:
 		else cfg_parser->cfg->verbosity = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3031 "util/configparser.c"
+#line 3055 "util/configparser.c"
     break;
 
-  case 280:
-#line 471 "./util/configparser.y"
+  case 283:
+#line 477 "./util/configparser.y"
         { 
 		OUTYY(("P(server_statistics_interval:%s)\n", (yyvsp[0].str))); 
 		if(strcmp((yyvsp[0].str), "") == 0 || strcmp((yyvsp[0].str), "0") == 0)
@@ -3041,11 +3065,11 @@ yyreduce:
 		else cfg_parser->cfg->stat_interval = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3045 "util/configparser.c"
+#line 3069 "util/configparser.c"
     break;
 
-  case 281:
-#line 482 "./util/configparser.y"
+  case 284:
+#line 488 "./util/configparser.y"
         {
 		OUTYY(("P(server_statistics_cumulative:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3053,11 +3077,11 @@ yyreduce:
 		else cfg_parser->cfg->stat_cumulative = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3057 "util/configparser.c"
+#line 3081 "util/configparser.c"
     break;
 
-  case 282:
-#line 491 "./util/configparser.y"
+  case 285:
+#line 497 "./util/configparser.y"
         {
 		OUTYY(("P(server_extended_statistics:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3065,11 +3089,11 @@ yyreduce:
 		else cfg_parser->cfg->stat_extended = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3069 "util/configparser.c"
+#line 3093 "util/configparser.c"
     break;
 
-  case 283:
-#line 500 "./util/configparser.y"
+  case 286:
+#line 506 "./util/configparser.y"
         {
 		OUTYY(("P(server_shm_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3077,11 +3101,11 @@ yyreduce:
 		else cfg_parser->cfg->shm_enable = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3081 "util/configparser.c"
+#line 3105 "util/configparser.c"
     break;
 
-  case 284:
-#line 509 "./util/configparser.y"
+  case 287:
+#line 515 "./util/configparser.y"
         { 
 		OUTYY(("P(server_shm_key:%s)\n", (yyvsp[0].str))); 
 		if(strcmp((yyvsp[0].str), "") == 0 || strcmp((yyvsp[0].str), "0") == 0)
@@ -3091,11 +3115,11 @@ yyreduce:
 		else cfg_parser->cfg->shm_key = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3095 "util/configparser.c"
+#line 3119 "util/configparser.c"
     break;
 
-  case 285:
-#line 520 "./util/configparser.y"
+  case 288:
+#line 526 "./util/configparser.y"
         {
 		OUTYY(("P(server_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3103,11 +3127,11 @@ yyreduce:
 		else cfg_parser->cfg->port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3107 "util/configparser.c"
+#line 3131 "util/configparser.c"
     break;
 
-  case 286:
-#line 529 "./util/configparser.y"
+  case 289:
+#line 535 "./util/configparser.y"
         {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(server_send_client_subnet:%s)\n", (yyvsp[0].str)));
@@ -3118,11 +3142,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 3122 "util/configparser.c"
+#line 3146 "util/configparser.c"
     break;
 
-  case 287:
-#line 541 "./util/configparser.y"
+  case 290:
+#line 547 "./util/configparser.y"
         {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(server_client_subnet_zone:%s)\n", (yyvsp[0].str)));
@@ -3134,11 +3158,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 3138 "util/configparser.c"
+#line 3162 "util/configparser.c"
     break;
 
-  case 288:
-#line 555 "./util/configparser.y"
+  case 291:
+#line 561 "./util/configparser.y"
         {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(server_client_subnet_always_forward:%s)\n", (yyvsp[0].str)));
@@ -3152,11 +3176,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 3156 "util/configparser.c"
+#line 3180 "util/configparser.c"
     break;
 
-  case 289:
-#line 570 "./util/configparser.y"
+  case 292:
+#line 576 "./util/configparser.y"
         {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(client_subnet_opcode:%s)\n", (yyvsp[0].str)));
@@ -3166,11 +3190,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 3170 "util/configparser.c"
+#line 3194 "util/configparser.c"
     break;
 
-  case 290:
-#line 581 "./util/configparser.y"
+  case 293:
+#line 587 "./util/configparser.y"
         {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(max_client_subnet_ipv4:%s)\n", (yyvsp[0].str)));
@@ -3186,11 +3210,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 3190 "util/configparser.c"
+#line 3214 "util/configparser.c"
     break;
 
-  case 291:
-#line 598 "./util/configparser.y"
+  case 294:
+#line 604 "./util/configparser.y"
         {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(max_client_subnet_ipv6:%s)\n", (yyvsp[0].str)));
@@ -3206,11 +3230,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 3210 "util/configparser.c"
+#line 3234 "util/configparser.c"
     break;
 
-  case 292:
-#line 615 "./util/configparser.y"
+  case 295:
+#line 621 "./util/configparser.y"
         {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(min_client_subnet_ipv4:%s)\n", (yyvsp[0].str)));
@@ -3226,11 +3250,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 3230 "util/configparser.c"
+#line 3254 "util/configparser.c"
     break;
 
-  case 293:
-#line 632 "./util/configparser.y"
+  case 296:
+#line 638 "./util/configparser.y"
         {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(min_client_subnet_ipv6:%s)\n", (yyvsp[0].str)));
@@ -3246,11 +3270,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 3250 "util/configparser.c"
+#line 3274 "util/configparser.c"
     break;
 
-  case 294:
-#line 649 "./util/configparser.y"
+  case 297:
+#line 655 "./util/configparser.y"
         {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(max_ecs_tree_size_ipv4:%s)\n", (yyvsp[0].str)));
@@ -3264,11 +3288,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 3268 "util/configparser.c"
+#line 3292 "util/configparser.c"
     break;
 
-  case 295:
-#line 664 "./util/configparser.y"
+  case 298:
+#line 670 "./util/configparser.y"
         {
 	#ifdef CLIENT_SUBNET
 		OUTYY(("P(max_ecs_tree_size_ipv6:%s)\n", (yyvsp[0].str)));
@@ -3282,11 +3306,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 3286 "util/configparser.c"
+#line 3310 "util/configparser.c"
     break;
 
-  case 296:
-#line 679 "./util/configparser.y"
+  case 299:
+#line 685 "./util/configparser.y"
         {
 		OUTYY(("P(server_interface:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->num_ifs == 0)
@@ -3298,11 +3322,11 @@ yyreduce:
 		else
 			cfg_parser->cfg->ifs[cfg_parser->cfg->num_ifs++] = (yyvsp[0].str);
 	}
-#line 3302 "util/configparser.c"
+#line 3326 "util/configparser.c"
     break;
 
-  case 297:
-#line 692 "./util/configparser.y"
+  case 300:
+#line 698 "./util/configparser.y"
         {
 		OUTYY(("P(server_outgoing_interface:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->num_out_ifs == 0)
@@ -3316,11 +3340,11 @@ yyreduce:
 			cfg_parser->cfg->out_ifs[
 				cfg_parser->cfg->num_out_ifs++] = (yyvsp[0].str);
 	}
-#line 3320 "util/configparser.c"
+#line 3344 "util/configparser.c"
     break;
 
-  case 298:
-#line 707 "./util/configparser.y"
+  case 301:
+#line 713 "./util/configparser.y"
         {
 		OUTYY(("P(server_outgoing_range:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3328,11 +3352,11 @@ yyreduce:
 		else cfg_parser->cfg->outgoing_num_ports = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3332 "util/configparser.c"
+#line 3356 "util/configparser.c"
     break;
 
-  case 299:
-#line 716 "./util/configparser.y"
+  case 302:
+#line 722 "./util/configparser.y"
         {
 		OUTYY(("P(server_outgoing_port_permit:%s)\n", (yyvsp[0].str)));
 		if(!cfg_mark_ports((yyvsp[0].str), 1, 
@@ -3340,11 +3364,11 @@ yyreduce:
 			yyerror("port number or range (\"low-high\") expected");
 		free((yyvsp[0].str));
 	}
-#line 3344 "util/configparser.c"
+#line 3368 "util/configparser.c"
     break;
 
-  case 300:
-#line 725 "./util/configparser.y"
+  case 303:
+#line 731 "./util/configparser.y"
         {
 		OUTYY(("P(server_outgoing_port_avoid:%s)\n", (yyvsp[0].str)));
 		if(!cfg_mark_ports((yyvsp[0].str), 0, 
@@ -3352,11 +3376,11 @@ yyreduce:
 			yyerror("port number or range (\"low-high\") expected");
 		free((yyvsp[0].str));
 	}
-#line 3356 "util/configparser.c"
+#line 3380 "util/configparser.c"
     break;
 
-  case 301:
-#line 734 "./util/configparser.y"
+  case 304:
+#line 740 "./util/configparser.y"
         {
 		OUTYY(("P(server_outgoing_num_tcp:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3364,11 +3388,11 @@ yyreduce:
 		else cfg_parser->cfg->outgoing_num_tcp = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3368 "util/configparser.c"
+#line 3392 "util/configparser.c"
     break;
 
-  case 302:
-#line 743 "./util/configparser.y"
+  case 305:
+#line 749 "./util/configparser.y"
         {
 		OUTYY(("P(server_incoming_num_tcp:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3376,11 +3400,11 @@ yyreduce:
 		else cfg_parser->cfg->incoming_num_tcp = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3380 "util/configparser.c"
+#line 3404 "util/configparser.c"
     break;
 
-  case 303:
-#line 752 "./util/configparser.y"
+  case 306:
+#line 758 "./util/configparser.y"
         {
 		OUTYY(("P(server_interface_automatic:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3388,11 +3412,11 @@ yyreduce:
 		else cfg_parser->cfg->if_automatic = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3392 "util/configparser.c"
+#line 3416 "util/configparser.c"
     break;
 
-  case 304:
-#line 761 "./util/configparser.y"
+  case 307:
+#line 767 "./util/configparser.y"
         {
 		OUTYY(("P(server_do_ip4:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3400,11 +3424,11 @@ yyreduce:
 		else cfg_parser->cfg->do_ip4 = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3404 "util/configparser.c"
+#line 3428 "util/configparser.c"
     break;
 
-  case 305:
-#line 770 "./util/configparser.y"
+  case 308:
+#line 776 "./util/configparser.y"
         {
 		OUTYY(("P(server_do_ip6:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3412,11 +3436,11 @@ yyreduce:
 		else cfg_parser->cfg->do_ip6 = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3416 "util/configparser.c"
+#line 3440 "util/configparser.c"
     break;
 
-  case 306:
-#line 779 "./util/configparser.y"
+  case 309:
+#line 785 "./util/configparser.y"
         {
 		OUTYY(("P(server_do_udp:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3424,11 +3448,11 @@ yyreduce:
 		else cfg_parser->cfg->do_udp = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3428 "util/configparser.c"
+#line 3452 "util/configparser.c"
     break;
 
-  case 307:
-#line 788 "./util/configparser.y"
+  case 310:
+#line 794 "./util/configparser.y"
         {
 		OUTYY(("P(server_do_tcp:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3436,11 +3460,11 @@ yyreduce:
 		else cfg_parser->cfg->do_tcp = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3440 "util/configparser.c"
+#line 3464 "util/configparser.c"
     break;
 
-  case 308:
-#line 797 "./util/configparser.y"
+  case 311:
+#line 803 "./util/configparser.y"
         {
 		OUTYY(("P(server_prefer_ip4:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3448,11 +3472,11 @@ yyreduce:
 		else cfg_parser->cfg->prefer_ip4 = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3452 "util/configparser.c"
+#line 3476 "util/configparser.c"
     break;
 
-  case 309:
-#line 806 "./util/configparser.y"
+  case 312:
+#line 812 "./util/configparser.y"
         {
 		OUTYY(("P(server_prefer_ip6:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3460,11 +3484,11 @@ yyreduce:
 		else cfg_parser->cfg->prefer_ip6 = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3464 "util/configparser.c"
+#line 3488 "util/configparser.c"
     break;
 
-  case 310:
-#line 815 "./util/configparser.y"
+  case 313:
+#line 821 "./util/configparser.y"
         {
 		OUTYY(("P(server_tcp_mss:%s)\n", (yyvsp[0].str)));
                 if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3472,11 +3496,11 @@ yyreduce:
                 else cfg_parser->cfg->tcp_mss = atoi((yyvsp[0].str));
                 free((yyvsp[0].str));
 	}
-#line 3476 "util/configparser.c"
+#line 3500 "util/configparser.c"
     break;
 
-  case 311:
-#line 824 "./util/configparser.y"
+  case 314:
+#line 830 "./util/configparser.y"
         {
 		OUTYY(("P(server_outgoing_tcp_mss:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3484,11 +3508,11 @@ yyreduce:
 		else cfg_parser->cfg->outgoing_tcp_mss = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3488 "util/configparser.c"
+#line 3512 "util/configparser.c"
     break;
 
-  case 312:
-#line 833 "./util/configparser.y"
+  case 315:
+#line 839 "./util/configparser.y"
         {
 		OUTYY(("P(server_tcp_idle_timeout:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3500,11 +3524,11 @@ yyreduce:
 		else cfg_parser->cfg->tcp_idle_timeout = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3504 "util/configparser.c"
+#line 3528 "util/configparser.c"
     break;
 
-  case 313:
-#line 846 "./util/configparser.y"
+  case 316:
+#line 852 "./util/configparser.y"
         {
 		OUTYY(("P(server_tcp_keepalive:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3512,11 +3536,11 @@ yyreduce:
 		else cfg_parser->cfg->do_tcp_keepalive = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3516 "util/configparser.c"
+#line 3540 "util/configparser.c"
     break;
 
-  case 314:
-#line 855 "./util/configparser.y"
+  case 317:
+#line 861 "./util/configparser.y"
         {
 		OUTYY(("P(server_tcp_keepalive_timeout:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3528,11 +3552,11 @@ yyreduce:
 		else cfg_parser->cfg->tcp_keepalive_timeout = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3532 "util/configparser.c"
+#line 3556 "util/configparser.c"
     break;
 
-  case 315:
-#line 868 "./util/configparser.y"
+  case 318:
+#line 874 "./util/configparser.y"
         {
 		OUTYY(("P(server_tcp_upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3540,11 +3564,11 @@ yyreduce:
 		else cfg_parser->cfg->tcp_upstream = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3544 "util/configparser.c"
+#line 3568 "util/configparser.c"
     break;
 
-  case 316:
-#line 877 "./util/configparser.y"
+  case 319:
+#line 883 "./util/configparser.y"
         {
 		OUTYY(("P(server_udp_upstream_without_downstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3552,11 +3576,11 @@ yyreduce:
 		else cfg_parser->cfg->udp_upstream_without_downstream = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3556 "util/configparser.c"
+#line 3580 "util/configparser.c"
     break;
 
-  case 317:
-#line 886 "./util/configparser.y"
+  case 320:
+#line 892 "./util/configparser.y"
         {
 		OUTYY(("P(server_ssl_upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3564,31 +3588,31 @@ yyreduce:
 		else cfg_parser->cfg->ssl_upstream = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3568 "util/configparser.c"
+#line 3592 "util/configparser.c"
     break;
 
-  case 318:
-#line 895 "./util/configparser.y"
+  case 321:
+#line 901 "./util/configparser.y"
         {
 		OUTYY(("P(server_ssl_service_key:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->ssl_service_key);
 		cfg_parser->cfg->ssl_service_key = (yyvsp[0].str);
 	}
-#line 3578 "util/configparser.c"
+#line 3602 "util/configparser.c"
     break;
 
-  case 319:
-#line 902 "./util/configparser.y"
+  case 322:
+#line 908 "./util/configparser.y"
         {
 		OUTYY(("P(server_ssl_service_pem:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->ssl_service_pem);
 		cfg_parser->cfg->ssl_service_pem = (yyvsp[0].str);
 	}
-#line 3588 "util/configparser.c"
+#line 3612 "util/configparser.c"
     break;
 
-  case 320:
-#line 909 "./util/configparser.y"
+  case 323:
+#line 915 "./util/configparser.y"
         {
 		OUTYY(("P(server_ssl_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -3596,21 +3620,21 @@ yyreduce:
 		else cfg_parser->cfg->ssl_port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3600 "util/configparser.c"
+#line 3624 "util/configparser.c"
     break;
 
-  case 321:
-#line 918 "./util/configparser.y"
+  case 324:
+#line 924 "./util/configparser.y"
         {
 		OUTYY(("P(server_tls_cert_bundle:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->tls_cert_bundle);
 		cfg_parser->cfg->tls_cert_bundle = (yyvsp[0].str);
 	}
-#line 3610 "util/configparser.c"
+#line 3634 "util/configparser.c"
     break;
 
-  case 322:
-#line 925 "./util/configparser.y"
+  case 325:
+#line 931 "./util/configparser.y"
         {
 		OUTYY(("P(server_tls_win_cert:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3618,53 +3642,53 @@ yyreduce:
 		else cfg_parser->cfg->tls_win_cert = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3622 "util/configparser.c"
+#line 3646 "util/configparser.c"
     break;
 
-  case 323:
-#line 934 "./util/configparser.y"
+  case 326:
+#line 940 "./util/configparser.y"
         {
 		OUTYY(("P(server_tls_additional_port:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->tls_additional_port,
 			(yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3633 "util/configparser.c"
+#line 3657 "util/configparser.c"
     break;
 
-  case 324:
-#line 942 "./util/configparser.y"
+  case 327:
+#line 948 "./util/configparser.y"
         {
 		OUTYY(("P(server_tls_ciphers:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->tls_ciphers);
 		cfg_parser->cfg->tls_ciphers = (yyvsp[0].str);
 	}
-#line 3643 "util/configparser.c"
+#line 3667 "util/configparser.c"
     break;
 
-  case 325:
-#line 949 "./util/configparser.y"
+  case 328:
+#line 955 "./util/configparser.y"
         {
 		OUTYY(("P(server_tls_ciphersuites:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->tls_ciphersuites);
 		cfg_parser->cfg->tls_ciphersuites = (yyvsp[0].str);
 	}
-#line 3653 "util/configparser.c"
+#line 3677 "util/configparser.c"
     break;
 
-  case 326:
-#line 956 "./util/configparser.y"
+  case 329:
+#line 962 "./util/configparser.y"
         {
 		OUTYY(("P(server_tls_session_ticket_keys:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_append(&cfg_parser->cfg->tls_session_ticket_keys,
 			(yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3664 "util/configparser.c"
+#line 3688 "util/configparser.c"
     break;
 
-  case 327:
-#line 964 "./util/configparser.y"
+  case 330:
+#line 970 "./util/configparser.y"
         {
 		OUTYY(("P(server_tls_use_sni:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3672,40 +3696,42 @@ yyreduce:
 		else cfg_parser->cfg->tls_use_sni = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3676 "util/configparser.c"
+#line 3700 "util/configparser.c"
     break;
 
-  case 328:
-#line 973 "./util/configparser.y"
+  case 331:
+#line 979 "./util/configparser.y"
         {
 		OUTYY(("P(server_https_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
 			yyerror("port number expected");
 		else cfg_parser->cfg->https_port = atoi((yyvsp[0].str));
 	}
-#line 3687 "util/configparser.c"
+#line 3711 "util/configparser.c"
     break;
 
-  case 329:
-#line 980 "./util/configparser.y"
+  case 332:
+#line 986 "./util/configparser.y"
         {
 		OUTYY(("P(server_http_endpoint:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->http_endpoint);
 		if((yyvsp[0].str) && (yyvsp[0].str)[0] != '/') {
 			cfg_parser->cfg->http_endpoint = malloc(strlen((yyvsp[0].str))+2);
+			if(!cfg_parser->cfg->http_endpoint)
+				yyerror("out of memory");
 			cfg_parser->cfg->http_endpoint[0] = '/';
-			memcpy(cfg_parser->cfg->http_endpoint+1, (yyvsp[0].str),
+			memmove(cfg_parser->cfg->http_endpoint+1, (yyvsp[0].str),
 				strlen((yyvsp[0].str))+1);
 			free((yyvsp[0].str));
 		} else {
 			cfg_parser->cfg->http_endpoint = (yyvsp[0].str);
 		}
 	}
-#line 3705 "util/configparser.c"
+#line 3731 "util/configparser.c"
     break;
 
-  case 330:
-#line 994 "./util/configparser.y"
+  case 333:
+#line 1002 "./util/configparser.y"
         {
 		OUTYY(("P(server_http_max_streams:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -3713,11 +3739,11 @@ yyreduce:
 		else cfg_parser->cfg->http_max_streams = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 3717 "util/configparser.c"
+#line 3743 "util/configparser.c"
     break;
 
-  case 331:
-#line 1002 "./util/configparser.y"
+  case 334:
+#line 1010 "./util/configparser.y"
         {
 		OUTYY(("P(server_http_query_buffer_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str),
@@ -3725,11 +3751,11 @@ yyreduce:
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 3729 "util/configparser.c"
+#line 3755 "util/configparser.c"
     break;
 
-  case 332:
-#line 1010 "./util/configparser.y"
+  case 335:
+#line 1018 "./util/configparser.y"
         {
 		OUTYY(("P(server_http_response_buffer_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str),
@@ -3737,11 +3763,11 @@ yyreduce:
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 3741 "util/configparser.c"
+#line 3767 "util/configparser.c"
     break;
 
-  case 333:
-#line 1018 "./util/configparser.y"
+  case 336:
+#line 1026 "./util/configparser.y"
         {
 		OUTYY(("P(server_http_nodelay:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3749,11 +3775,11 @@ yyreduce:
 		else cfg_parser->cfg->http_nodelay = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3753 "util/configparser.c"
+#line 3779 "util/configparser.c"
     break;
 
-  case 334:
-#line 1026 "./util/configparser.y"
+  case 337:
+#line 1034 "./util/configparser.y"
         {
 		OUTYY(("P(server_use_systemd:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3761,11 +3787,11 @@ yyreduce:
 		else cfg_parser->cfg->use_systemd = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3765 "util/configparser.c"
+#line 3791 "util/configparser.c"
     break;
 
-  case 335:
-#line 1035 "./util/configparser.y"
+  case 338:
+#line 1043 "./util/configparser.y"
         {
 		OUTYY(("P(server_do_daemonize:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3773,11 +3799,11 @@ yyreduce:
 		else cfg_parser->cfg->do_daemonize = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3777 "util/configparser.c"
+#line 3803 "util/configparser.c"
     break;
 
-  case 336:
-#line 1044 "./util/configparser.y"
+  case 339:
+#line 1052 "./util/configparser.y"
         {
 		OUTYY(("P(server_use_syslog:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3790,11 +3816,11 @@ yyreduce:
 #endif
 		free((yyvsp[0].str));
 	}
-#line 3794 "util/configparser.c"
+#line 3820 "util/configparser.c"
     break;
 
-  case 337:
-#line 1058 "./util/configparser.y"
+  case 340:
+#line 1066 "./util/configparser.y"
         {
 		OUTYY(("P(server_log_time_ascii:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3802,11 +3828,11 @@ yyreduce:
 		else cfg_parser->cfg->log_time_ascii = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3806 "util/configparser.c"
+#line 3832 "util/configparser.c"
     break;
 
-  case 338:
-#line 1067 "./util/configparser.y"
+  case 341:
+#line 1075 "./util/configparser.y"
         {
 		OUTYY(("P(server_log_queries:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3814,11 +3840,11 @@ yyreduce:
 		else cfg_parser->cfg->log_queries = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3818 "util/configparser.c"
+#line 3844 "util/configparser.c"
     break;
 
-  case 339:
-#line 1076 "./util/configparser.y"
+  case 342:
+#line 1084 "./util/configparser.y"
   {
   	OUTYY(("P(server_log_replies:%s)\n", (yyvsp[0].str)));
   	if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3826,11 +3852,11 @@ yyreduce:
   	else cfg_parser->cfg->log_replies = (strcmp((yyvsp[0].str), "yes")==0);
   	free((yyvsp[0].str));
   }
-#line 3830 "util/configparser.c"
+#line 3856 "util/configparser.c"
     break;
 
-  case 340:
-#line 1085 "./util/configparser.y"
+  case 343:
+#line 1093 "./util/configparser.y"
   {
   	OUTYY(("P(server_log_tag_queryreply:%s)\n", (yyvsp[0].str)));
   	if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3838,11 +3864,11 @@ yyreduce:
   	else cfg_parser->cfg->log_tag_queryreply = (strcmp((yyvsp[0].str), "yes")==0);
   	free((yyvsp[0].str));
   }
-#line 3842 "util/configparser.c"
+#line 3868 "util/configparser.c"
     break;
 
-  case 341:
-#line 1094 "./util/configparser.y"
+  case 344:
+#line 1102 "./util/configparser.y"
         {
 		OUTYY(("P(server_log_servfail:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3850,11 +3876,11 @@ yyreduce:
 		else cfg_parser->cfg->log_servfail = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 3854 "util/configparser.c"
+#line 3880 "util/configparser.c"
     break;
 
-  case 342:
-#line 1103 "./util/configparser.y"
+  case 345:
+#line 1111 "./util/configparser.y"
   {
   	OUTYY(("P(server_log_local_actions:%s)\n", (yyvsp[0].str)));
   	if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -3862,31 +3888,31 @@ yyreduce:
   	else cfg_parser->cfg->log_local_actions = (strcmp((yyvsp[0].str), "yes")==0);
   	free((yyvsp[0].str));
   }
-#line 3866 "util/configparser.c"
+#line 3892 "util/configparser.c"
     break;
 
-  case 343:
-#line 1112 "./util/configparser.y"
+  case 346:
+#line 1120 "./util/configparser.y"
         {
 		OUTYY(("P(server_chroot:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->chrootdir);
 		cfg_parser->cfg->chrootdir = (yyvsp[0].str);
 	}
-#line 3876 "util/configparser.c"
+#line 3902 "util/configparser.c"
     break;
 
-  case 344:
-#line 1119 "./util/configparser.y"
+  case 347:
+#line 1127 "./util/configparser.y"
         {
 		OUTYY(("P(server_username:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->username);
 		cfg_parser->cfg->username = (yyvsp[0].str);
 	}
-#line 3886 "util/configparser.c"
+#line 3912 "util/configparser.c"
     break;
 
-  case 345:
-#line 1126 "./util/configparser.y"
+  case 348:
+#line 1134 "./util/configparser.y"
         {
 		OUTYY(("P(server_directory:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->directory);
@@ -3911,105 +3937,105 @@ yyreduce:
 			}
 		}
 	}
-#line 3915 "util/configparser.c"
+#line 3941 "util/configparser.c"
     break;
 
-  case 346:
-#line 1152 "./util/configparser.y"
+  case 349:
+#line 1160 "./util/configparser.y"
         {
 		OUTYY(("P(server_logfile:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->logfile);
 		cfg_parser->cfg->logfile = (yyvsp[0].str);
 		cfg_parser->cfg->use_syslog = 0;
 	}
-#line 3926 "util/configparser.c"
+#line 3952 "util/configparser.c"
     break;
 
-  case 347:
-#line 1160 "./util/configparser.y"
+  case 350:
+#line 1168 "./util/configparser.y"
         {
 		OUTYY(("P(server_pidfile:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->pidfile);
 		cfg_parser->cfg->pidfile = (yyvsp[0].str);
 	}
-#line 3936 "util/configparser.c"
+#line 3962 "util/configparser.c"
     break;
 
-  case 348:
-#line 1167 "./util/configparser.y"
+  case 351:
+#line 1175 "./util/configparser.y"
         {
 		OUTYY(("P(server_root_hints:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->root_hints, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3946 "util/configparser.c"
+#line 3972 "util/configparser.c"
     break;
 
-  case 349:
-#line 1174 "./util/configparser.y"
+  case 352:
+#line 1182 "./util/configparser.y"
         {
 		OUTYY(("P(server_dlv_anchor_file:%s)\n", (yyvsp[0].str)));
-		free(cfg_parser->cfg->dlv_anchor_file);
-		cfg_parser->cfg->dlv_anchor_file = (yyvsp[0].str);
+		log_warn("option dlv-anchor-file ignored: DLV is decommissioned");
+		free((yyvsp[0].str));
 	}
-#line 3956 "util/configparser.c"
+#line 3982 "util/configparser.c"
     break;
 
-  case 350:
-#line 1181 "./util/configparser.y"
+  case 353:
+#line 1189 "./util/configparser.y"
         {
 		OUTYY(("P(server_dlv_anchor:%s)\n", (yyvsp[0].str)));
-		if(!cfg_strlist_insert(&cfg_parser->cfg->dlv_anchor_list, (yyvsp[0].str)))
-			yyerror("out of memory");
+		log_warn("option dlv-anchor ignored: DLV is decommissioned");
+		free((yyvsp[0].str));
 	}
-#line 3966 "util/configparser.c"
+#line 3992 "util/configparser.c"
     break;
 
-  case 351:
-#line 1188 "./util/configparser.y"
+  case 354:
+#line 1196 "./util/configparser.y"
         {
 		OUTYY(("P(server_auto_trust_anchor_file:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
 			auto_trust_anchor_file_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3977 "util/configparser.c"
+#line 4003 "util/configparser.c"
     break;
 
-  case 352:
-#line 1196 "./util/configparser.y"
+  case 355:
+#line 1204 "./util/configparser.y"
         {
 		OUTYY(("P(server_trust_anchor_file:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
 			trust_anchor_file_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3988 "util/configparser.c"
+#line 4014 "util/configparser.c"
     break;
 
-  case 353:
-#line 1204 "./util/configparser.y"
+  case 356:
+#line 1212 "./util/configparser.y"
         {
 		OUTYY(("P(server_trusted_keys_file:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->
 			trusted_keys_file_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 3999 "util/configparser.c"
+#line 4025 "util/configparser.c"
     break;
 
-  case 354:
-#line 1212 "./util/configparser.y"
+  case 357:
+#line 1220 "./util/configparser.y"
         {
 		OUTYY(("P(server_trust_anchor:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->trust_anchor_list, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 4009 "util/configparser.c"
+#line 4035 "util/configparser.c"
     break;
 
-  case 355:
-#line 1219 "./util/configparser.y"
+  case 358:
+#line 1227 "./util/configparser.y"
         {
 		OUTYY(("P(server_trust_anchor_signaling:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4019,11 +4045,11 @@ yyreduce:
 				(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4023 "util/configparser.c"
+#line 4049 "util/configparser.c"
     break;
 
-  case 356:
-#line 1230 "./util/configparser.y"
+  case 359:
+#line 1238 "./util/configparser.y"
         {
 		OUTYY(("P(server_root_key_sentinel:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4033,21 +4059,21 @@ yyreduce:
 				(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4037 "util/configparser.c"
+#line 4063 "util/configparser.c"
     break;
 
-  case 357:
-#line 1241 "./util/configparser.y"
+  case 360:
+#line 1249 "./util/configparser.y"
         {
 		OUTYY(("P(server_domain_insecure:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->domain_insecure, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 4047 "util/configparser.c"
+#line 4073 "util/configparser.c"
     break;
 
-  case 358:
-#line 1248 "./util/configparser.y"
+  case 361:
+#line 1256 "./util/configparser.y"
         {
 		OUTYY(("P(server_hide_identity:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4055,11 +4081,11 @@ yyreduce:
 		else cfg_parser->cfg->hide_identity = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4059 "util/configparser.c"
+#line 4085 "util/configparser.c"
     break;
 
-  case 359:
-#line 1257 "./util/configparser.y"
+  case 362:
+#line 1265 "./util/configparser.y"
         {
 		OUTYY(("P(server_hide_version:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4067,11 +4093,11 @@ yyreduce:
 		else cfg_parser->cfg->hide_version = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4071 "util/configparser.c"
+#line 4097 "util/configparser.c"
     break;
 
-  case 360:
-#line 1266 "./util/configparser.y"
+  case 363:
+#line 1274 "./util/configparser.y"
         {
 		OUTYY(("P(server_hide_trustanchor:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4079,53 +4105,53 @@ yyreduce:
 		else cfg_parser->cfg->hide_trustanchor = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4083 "util/configparser.c"
+#line 4109 "util/configparser.c"
     break;
 
-  case 361:
-#line 1275 "./util/configparser.y"
+  case 364:
+#line 1283 "./util/configparser.y"
         {
 		OUTYY(("P(server_identity:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->identity);
 		cfg_parser->cfg->identity = (yyvsp[0].str);
 	}
-#line 4093 "util/configparser.c"
+#line 4119 "util/configparser.c"
     break;
 
-  case 362:
-#line 1282 "./util/configparser.y"
+  case 365:
+#line 1290 "./util/configparser.y"
         {
 		OUTYY(("P(server_version:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->version);
 		cfg_parser->cfg->version = (yyvsp[0].str);
 	}
-#line 4103 "util/configparser.c"
+#line 4129 "util/configparser.c"
     break;
 
-  case 363:
-#line 1289 "./util/configparser.y"
+  case 366:
+#line 1297 "./util/configparser.y"
         {
 		OUTYY(("P(server_so_rcvbuf:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->so_rcvbuf))
 			yyerror("buffer size expected");
 		free((yyvsp[0].str));
 	}
-#line 4114 "util/configparser.c"
+#line 4140 "util/configparser.c"
     break;
 
-  case 364:
-#line 1297 "./util/configparser.y"
+  case 367:
+#line 1305 "./util/configparser.y"
         {
 		OUTYY(("P(server_so_sndbuf:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->so_sndbuf))
 			yyerror("buffer size expected");
 		free((yyvsp[0].str));
 	}
-#line 4125 "util/configparser.c"
+#line 4151 "util/configparser.c"
     break;
 
-  case 365:
-#line 1305 "./util/configparser.y"
+  case 368:
+#line 1313 "./util/configparser.y"
     {
         OUTYY(("P(server_so_reuseport:%s)\n", (yyvsp[0].str)));
         if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4134,11 +4160,11 @@ yyreduce:
             (strcmp((yyvsp[0].str), "yes")==0);
         free((yyvsp[0].str));
     }
-#line 4138 "util/configparser.c"
+#line 4164 "util/configparser.c"
     break;
 
-  case 366:
-#line 1315 "./util/configparser.y"
+  case 369:
+#line 1323 "./util/configparser.y"
     {
         OUTYY(("P(server_ip_transparent:%s)\n", (yyvsp[0].str)));
         if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4147,11 +4173,11 @@ yyreduce:
             (strcmp((yyvsp[0].str), "yes")==0);
         free((yyvsp[0].str));
     }
-#line 4151 "util/configparser.c"
+#line 4177 "util/configparser.c"
     break;
 
-  case 367:
-#line 1325 "./util/configparser.y"
+  case 370:
+#line 1333 "./util/configparser.y"
     {
         OUTYY(("P(server_ip_freebind:%s)\n", (yyvsp[0].str)));
         if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4160,11 +4186,11 @@ yyreduce:
             (strcmp((yyvsp[0].str), "yes")==0);
         free((yyvsp[0].str));
     }
-#line 4164 "util/configparser.c"
+#line 4190 "util/configparser.c"
     break;
 
-  case 368:
-#line 1335 "./util/configparser.y"
+  case 371:
+#line 1343 "./util/configparser.y"
         {
 		OUTYY(("P(server_ip_dscp:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4177,22 +4203,22 @@ yyreduce:
 			cfg_parser->cfg->ip_dscp = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4181 "util/configparser.c"
+#line 4207 "util/configparser.c"
     break;
 
-  case 369:
-#line 1349 "./util/configparser.y"
+  case 372:
+#line 1357 "./util/configparser.y"
         {
 		OUTYY(("P(server_stream_wait_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->stream_wait_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 4192 "util/configparser.c"
+#line 4218 "util/configparser.c"
     break;
 
-  case 370:
-#line 1357 "./util/configparser.y"
+  case 373:
+#line 1365 "./util/configparser.y"
         {
 		OUTYY(("P(server_edns_buffer_size:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -4204,11 +4230,11 @@ yyreduce:
 		else cfg_parser->cfg->edns_buffer_size = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4208 "util/configparser.c"
+#line 4234 "util/configparser.c"
     break;
 
-  case 371:
-#line 1370 "./util/configparser.y"
+  case 374:
+#line 1378 "./util/configparser.y"
         {
 		OUTYY(("P(server_msg_buffer_size:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -4218,22 +4244,22 @@ yyreduce:
 		else cfg_parser->cfg->msg_buffer_size = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4222 "util/configparser.c"
+#line 4248 "util/configparser.c"
     break;
 
-  case 372:
-#line 1381 "./util/configparser.y"
+  case 375:
+#line 1389 "./util/configparser.y"
         {
 		OUTYY(("P(server_msg_cache_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->msg_cache_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 4233 "util/configparser.c"
+#line 4259 "util/configparser.c"
     break;
 
-  case 373:
-#line 1389 "./util/configparser.y"
+  case 376:
+#line 1397 "./util/configparser.y"
         {
 		OUTYY(("P(server_msg_cache_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -4245,11 +4271,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 4249 "util/configparser.c"
+#line 4275 "util/configparser.c"
     break;
 
-  case 374:
-#line 1402 "./util/configparser.y"
+  case 377:
+#line 1410 "./util/configparser.y"
         {
 		OUTYY(("P(server_num_queries_per_thread:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -4257,11 +4283,11 @@ yyreduce:
 		else cfg_parser->cfg->num_queries_per_thread = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4261 "util/configparser.c"
+#line 4287 "util/configparser.c"
     break;
 
-  case 375:
-#line 1411 "./util/configparser.y"
+  case 378:
+#line 1419 "./util/configparser.y"
         {
 		OUTYY(("P(server_jostle_timeout:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4269,11 +4295,11 @@ yyreduce:
 		else cfg_parser->cfg->jostle_time = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4273 "util/configparser.c"
+#line 4299 "util/configparser.c"
     break;
 
-  case 376:
-#line 1420 "./util/configparser.y"
+  case 379:
+#line 1428 "./util/configparser.y"
         {
 		OUTYY(("P(server_delay_close:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4281,11 +4307,11 @@ yyreduce:
 		else cfg_parser->cfg->delay_close = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4285 "util/configparser.c"
+#line 4311 "util/configparser.c"
     break;
 
-  case 377:
-#line 1429 "./util/configparser.y"
+  case 380:
+#line 1437 "./util/configparser.y"
         {
 		OUTYY(("P(server_unblock_lan_zones:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4294,11 +4320,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4298 "util/configparser.c"
+#line 4324 "util/configparser.c"
     break;
 
-  case 378:
-#line 1439 "./util/configparser.y"
+  case 381:
+#line 1447 "./util/configparser.y"
         {
 		OUTYY(("P(server_insecure_lan_zones:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4307,22 +4333,22 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4311 "util/configparser.c"
+#line 4337 "util/configparser.c"
     break;
 
-  case 379:
-#line 1449 "./util/configparser.y"
+  case 382:
+#line 1457 "./util/configparser.y"
         {
 		OUTYY(("P(server_rrset_cache_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->rrset_cache_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 4322 "util/configparser.c"
+#line 4348 "util/configparser.c"
     break;
 
-  case 380:
-#line 1457 "./util/configparser.y"
+  case 383:
+#line 1465 "./util/configparser.y"
         {
 		OUTYY(("P(server_rrset_cache_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -4334,11 +4360,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 4338 "util/configparser.c"
+#line 4364 "util/configparser.c"
     break;
 
-  case 381:
-#line 1470 "./util/configparser.y"
+  case 384:
+#line 1478 "./util/configparser.y"
         {
 		OUTYY(("P(server_infra_host_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4346,22 +4372,22 @@ yyreduce:
 		else cfg_parser->cfg->host_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4350 "util/configparser.c"
+#line 4376 "util/configparser.c"
     break;
 
-  case 382:
-#line 1479 "./util/configparser.y"
+  case 385:
+#line 1487 "./util/configparser.y"
         {
 		OUTYY(("P(server_infra_lame_ttl:%s)\n", (yyvsp[0].str)));
 		verbose(VERB_DETAIL, "ignored infra-lame-ttl: %s (option "
 			"removed, use infra-host-ttl)", (yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4361 "util/configparser.c"
+#line 4387 "util/configparser.c"
     break;
 
-  case 383:
-#line 1487 "./util/configparser.y"
+  case 386:
+#line 1495 "./util/configparser.y"
         {
 		OUTYY(("P(server_infra_cache_numhosts:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -4369,22 +4395,22 @@ yyreduce:
 		else cfg_parser->cfg->infra_cache_numhosts = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4373 "util/configparser.c"
+#line 4399 "util/configparser.c"
     break;
 
-  case 384:
-#line 1496 "./util/configparser.y"
+  case 387:
+#line 1504 "./util/configparser.y"
         {
 		OUTYY(("P(server_infra_cache_lame_size:%s)\n", (yyvsp[0].str)));
 		verbose(VERB_DETAIL, "ignored infra-cache-lame-size: %s "
 			"(option removed, use infra-cache-numhosts)", (yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4384 "util/configparser.c"
+#line 4410 "util/configparser.c"
     break;
 
-  case 385:
-#line 1504 "./util/configparser.y"
+  case 388:
+#line 1512 "./util/configparser.y"
         {
 		OUTYY(("P(server_infra_cache_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -4396,11 +4422,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 4400 "util/configparser.c"
+#line 4426 "util/configparser.c"
     break;
 
-  case 386:
-#line 1517 "./util/configparser.y"
+  case 389:
+#line 1525 "./util/configparser.y"
         {
 		OUTYY(("P(server_infra_cache_min_rtt:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4408,21 +4434,21 @@ yyreduce:
 		else cfg_parser->cfg->infra_cache_min_rtt = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4412 "util/configparser.c"
+#line 4438 "util/configparser.c"
     break;
 
-  case 387:
-#line 1526 "./util/configparser.y"
+  case 390:
+#line 1534 "./util/configparser.y"
         {
 		OUTYY(("P(server_target_fetch_policy:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->target_fetch_policy);
 		cfg_parser->cfg->target_fetch_policy = (yyvsp[0].str);
 	}
-#line 4422 "util/configparser.c"
+#line 4448 "util/configparser.c"
     break;
 
-  case 388:
-#line 1533 "./util/configparser.y"
+  case 391:
+#line 1541 "./util/configparser.y"
         {
 		OUTYY(("P(server_harden_short_bufsize:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4431,11 +4457,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4435 "util/configparser.c"
+#line 4461 "util/configparser.c"
     break;
 
-  case 389:
-#line 1543 "./util/configparser.y"
+  case 392:
+#line 1551 "./util/configparser.y"
         {
 		OUTYY(("P(server_harden_large_queries:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4444,11 +4470,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4448 "util/configparser.c"
+#line 4474 "util/configparser.c"
     break;
 
-  case 390:
-#line 1553 "./util/configparser.y"
+  case 393:
+#line 1561 "./util/configparser.y"
         {
 		OUTYY(("P(server_harden_glue:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4457,11 +4483,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4461 "util/configparser.c"
+#line 4487 "util/configparser.c"
     break;
 
-  case 391:
-#line 1563 "./util/configparser.y"
+  case 394:
+#line 1571 "./util/configparser.y"
         {
 		OUTYY(("P(server_harden_dnssec_stripped:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4470,11 +4496,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4474 "util/configparser.c"
+#line 4500 "util/configparser.c"
     break;
 
-  case 392:
-#line 1573 "./util/configparser.y"
+  case 395:
+#line 1581 "./util/configparser.y"
         {
 		OUTYY(("P(server_harden_below_nxdomain:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4483,11 +4509,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4487 "util/configparser.c"
+#line 4513 "util/configparser.c"
     break;
 
-  case 393:
-#line 1583 "./util/configparser.y"
+  case 396:
+#line 1591 "./util/configparser.y"
         {
 		OUTYY(("P(server_harden_referral_path:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4496,11 +4522,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4500 "util/configparser.c"
+#line 4526 "util/configparser.c"
     break;
 
-  case 394:
-#line 1593 "./util/configparser.y"
+  case 397:
+#line 1601 "./util/configparser.y"
         {
 		OUTYY(("P(server_harden_algo_downgrade:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4509,11 +4535,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4513 "util/configparser.c"
+#line 4539 "util/configparser.c"
     break;
 
-  case 395:
-#line 1603 "./util/configparser.y"
+  case 398:
+#line 1611 "./util/configparser.y"
         {
 		OUTYY(("P(server_use_caps_for_id:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4522,41 +4548,41 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4526 "util/configparser.c"
+#line 4552 "util/configparser.c"
     break;
 
-  case 396:
-#line 1613 "./util/configparser.y"
+  case 399:
+#line 1621 "./util/configparser.y"
         {
 		OUTYY(("P(server_caps_whitelist:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->caps_whitelist, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 4536 "util/configparser.c"
+#line 4562 "util/configparser.c"
     break;
 
-  case 397:
-#line 1620 "./util/configparser.y"
+  case 400:
+#line 1628 "./util/configparser.y"
         {
 		OUTYY(("P(server_private_address:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->private_address, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 4546 "util/configparser.c"
+#line 4572 "util/configparser.c"
     break;
 
-  case 398:
-#line 1627 "./util/configparser.y"
+  case 401:
+#line 1635 "./util/configparser.y"
         {
 		OUTYY(("P(server_private_domain:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->private_domain, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 4556 "util/configparser.c"
+#line 4582 "util/configparser.c"
     break;
 
-  case 399:
-#line 1634 "./util/configparser.y"
+  case 402:
+#line 1642 "./util/configparser.y"
         {
 		OUTYY(("P(server_prefetch:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4564,11 +4590,11 @@ yyreduce:
 		else cfg_parser->cfg->prefetch = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4568 "util/configparser.c"
+#line 4594 "util/configparser.c"
     break;
 
-  case 400:
-#line 1643 "./util/configparser.y"
+  case 403:
+#line 1651 "./util/configparser.y"
         {
 		OUTYY(("P(server_prefetch_key:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4576,11 +4602,11 @@ yyreduce:
 		else cfg_parser->cfg->prefetch_key = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4580 "util/configparser.c"
+#line 4606 "util/configparser.c"
     break;
 
-  case 401:
-#line 1652 "./util/configparser.y"
+  case 404:
+#line 1660 "./util/configparser.y"
         {
 		OUTYY(("P(server_deny_any:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4588,11 +4614,11 @@ yyreduce:
 		else cfg_parser->cfg->deny_any = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4592 "util/configparser.c"
+#line 4618 "util/configparser.c"
     break;
 
-  case 402:
-#line 1661 "./util/configparser.y"
+  case 405:
+#line 1669 "./util/configparser.y"
         {
 		OUTYY(("P(server_unwanted_reply_threshold:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4600,21 +4626,21 @@ yyreduce:
 		else cfg_parser->cfg->unwanted_threshold = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4604 "util/configparser.c"
+#line 4630 "util/configparser.c"
     break;
 
-  case 403:
-#line 1670 "./util/configparser.y"
+  case 406:
+#line 1678 "./util/configparser.y"
         {
 		OUTYY(("P(server_do_not_query_address:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->donotqueryaddrs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 4614 "util/configparser.c"
+#line 4640 "util/configparser.c"
     break;
 
-  case 404:
-#line 1677 "./util/configparser.y"
+  case 407:
+#line 1685 "./util/configparser.y"
         {
 		OUTYY(("P(server_do_not_query_localhost:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4623,11 +4649,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4627 "util/configparser.c"
+#line 4653 "util/configparser.c"
     break;
 
-  case 405:
-#line 1687 "./util/configparser.y"
+  case 408:
+#line 1695 "./util/configparser.y"
         {
 		OUTYY(("P(server_access_control:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "deny")!=0 && strcmp((yyvsp[0].str), "refuse")!=0 &&
@@ -4646,21 +4672,21 @@ yyreduce:
 				fatal_exit("out of memory adding acl");
 		}
 	}
-#line 4650 "util/configparser.c"
+#line 4676 "util/configparser.c"
     break;
 
-  case 406:
-#line 1707 "./util/configparser.y"
+  case 409:
+#line 1715 "./util/configparser.y"
         {
 		OUTYY(("P(server_module_conf:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->module_conf);
 		cfg_parser->cfg->module_conf = (yyvsp[0].str);
 	}
-#line 4660 "util/configparser.c"
+#line 4686 "util/configparser.c"
     break;
 
-  case 407:
-#line 1714 "./util/configparser.y"
+  case 410:
+#line 1722 "./util/configparser.y"
         {
 		OUTYY(("P(server_val_override_date:%s)\n", (yyvsp[0].str)));
 		if(*(yyvsp[0].str) == '\0' || strcmp((yyvsp[0].str), "0") == 0) {
@@ -4677,11 +4703,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 4681 "util/configparser.c"
+#line 4707 "util/configparser.c"
     break;
 
-  case 408:
-#line 1732 "./util/configparser.y"
+  case 411:
+#line 1740 "./util/configparser.y"
         {
 		OUTYY(("P(server_val_sig_skew_min:%s)\n", (yyvsp[0].str)));
 		if(*(yyvsp[0].str) == '\0' || strcmp((yyvsp[0].str), "0") == 0) {
@@ -4693,11 +4719,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 4697 "util/configparser.c"
+#line 4723 "util/configparser.c"
     break;
 
-  case 409:
-#line 1745 "./util/configparser.y"
+  case 412:
+#line 1753 "./util/configparser.y"
         {
 		OUTYY(("P(server_val_sig_skew_max:%s)\n", (yyvsp[0].str)));
 		if(*(yyvsp[0].str) == '\0' || strcmp((yyvsp[0].str), "0") == 0) {
@@ -4709,11 +4735,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 4713 "util/configparser.c"
+#line 4739 "util/configparser.c"
     break;
 
-  case 410:
-#line 1758 "./util/configparser.y"
+  case 413:
+#line 1766 "./util/configparser.y"
         {
 		OUTYY(("P(server_cache_max_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4721,11 +4747,11 @@ yyreduce:
 		else cfg_parser->cfg->max_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4725 "util/configparser.c"
+#line 4751 "util/configparser.c"
     break;
 
-  case 411:
-#line 1767 "./util/configparser.y"
+  case 414:
+#line 1775 "./util/configparser.y"
         {
 		OUTYY(("P(server_cache_max_negative_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4733,11 +4759,11 @@ yyreduce:
 		else cfg_parser->cfg->max_negative_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4737 "util/configparser.c"
+#line 4763 "util/configparser.c"
     break;
 
-  case 412:
-#line 1776 "./util/configparser.y"
+  case 415:
+#line 1784 "./util/configparser.y"
         {
 		OUTYY(("P(server_cache_min_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4745,11 +4771,11 @@ yyreduce:
 		else cfg_parser->cfg->min_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4749 "util/configparser.c"
+#line 4775 "util/configparser.c"
     break;
 
-  case 413:
-#line 1785 "./util/configparser.y"
+  case 416:
+#line 1793 "./util/configparser.y"
         {
 		OUTYY(("P(server_bogus_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4757,11 +4783,11 @@ yyreduce:
 		else cfg_parser->cfg->bogus_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4761 "util/configparser.c"
+#line 4787 "util/configparser.c"
     break;
 
-  case 414:
-#line 1794 "./util/configparser.y"
+  case 417:
+#line 1802 "./util/configparser.y"
         {
 		OUTYY(("P(server_val_clean_additional:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4770,11 +4796,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4774 "util/configparser.c"
+#line 4800 "util/configparser.c"
     break;
 
-  case 415:
-#line 1804 "./util/configparser.y"
+  case 418:
+#line 1812 "./util/configparser.y"
         {
 		OUTYY(("P(server_val_permissive_mode:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4783,11 +4809,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4787 "util/configparser.c"
+#line 4813 "util/configparser.c"
     break;
 
-  case 416:
-#line 1814 "./util/configparser.y"
+  case 419:
+#line 1822 "./util/configparser.y"
         {
 		OUTYY(("P(server_aggressive_nsec:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4797,11 +4823,11 @@ yyreduce:
 				(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4801 "util/configparser.c"
+#line 4827 "util/configparser.c"
     break;
 
-  case 417:
-#line 1825 "./util/configparser.y"
+  case 420:
+#line 1833 "./util/configparser.y"
         {
 		OUTYY(("P(server_ignore_cd_flag:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4809,11 +4835,11 @@ yyreduce:
 		else cfg_parser->cfg->ignore_cd = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4813 "util/configparser.c"
+#line 4839 "util/configparser.c"
     break;
 
-  case 418:
-#line 1834 "./util/configparser.y"
+  case 421:
+#line 1842 "./util/configparser.y"
         {
 		OUTYY(("P(server_serve_expired:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4821,11 +4847,11 @@ yyreduce:
 		else cfg_parser->cfg->serve_expired = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4825 "util/configparser.c"
+#line 4851 "util/configparser.c"
     break;
 
-  case 419:
-#line 1843 "./util/configparser.y"
+  case 422:
+#line 1851 "./util/configparser.y"
         {
 		OUTYY(("P(server_serve_expired_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4833,11 +4859,11 @@ yyreduce:
 		else cfg_parser->cfg->serve_expired_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4837 "util/configparser.c"
+#line 4863 "util/configparser.c"
     break;
 
-  case 420:
-#line 1852 "./util/configparser.y"
+  case 423:
+#line 1860 "./util/configparser.y"
         {
 		OUTYY(("P(server_serve_expired_ttl_reset:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4845,11 +4871,11 @@ yyreduce:
 		else cfg_parser->cfg->serve_expired_ttl_reset = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4849 "util/configparser.c"
+#line 4875 "util/configparser.c"
     break;
 
-  case 421:
-#line 1861 "./util/configparser.y"
+  case 424:
+#line 1869 "./util/configparser.y"
         {
 		OUTYY(("P(server_serve_expired_reply_ttl:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4857,11 +4883,11 @@ yyreduce:
 		else cfg_parser->cfg->serve_expired_reply_ttl = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4861 "util/configparser.c"
+#line 4887 "util/configparser.c"
     break;
 
-  case 422:
-#line 1870 "./util/configparser.y"
+  case 425:
+#line 1878 "./util/configparser.y"
         {
 		OUTYY(("P(server_serve_expired_client_timeout:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4869,11 +4895,11 @@ yyreduce:
 		else cfg_parser->cfg->serve_expired_client_timeout = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4873 "util/configparser.c"
+#line 4899 "util/configparser.c"
     break;
 
-  case 423:
-#line 1879 "./util/configparser.y"
+  case 426:
+#line 1887 "./util/configparser.y"
         {
 		OUTYY(("P(server_fake_dsa:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4885,11 +4911,11 @@ yyreduce:
 #endif
 		free((yyvsp[0].str));
 	}
-#line 4889 "util/configparser.c"
+#line 4915 "util/configparser.c"
     break;
 
-  case 424:
-#line 1892 "./util/configparser.y"
+  case 427:
+#line 1900 "./util/configparser.y"
         {
 		OUTYY(("P(server_fake_sha1:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4901,11 +4927,11 @@ yyreduce:
 #endif
 		free((yyvsp[0].str));
 	}
-#line 4905 "util/configparser.c"
+#line 4931 "util/configparser.c"
     break;
 
-  case 425:
-#line 1905 "./util/configparser.y"
+  case 428:
+#line 1913 "./util/configparser.y"
         {
 		OUTYY(("P(server_val_log_level:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4913,21 +4939,21 @@ yyreduce:
 		else cfg_parser->cfg->val_log_level = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4917 "util/configparser.c"
+#line 4943 "util/configparser.c"
     break;
 
-  case 426:
-#line 1914 "./util/configparser.y"
+  case 429:
+#line 1922 "./util/configparser.y"
         {
 		OUTYY(("P(server_val_nsec3_keysize_iterations:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->val_nsec3_key_iterations);
 		cfg_parser->cfg->val_nsec3_key_iterations = (yyvsp[0].str);
 	}
-#line 4927 "util/configparser.c"
+#line 4953 "util/configparser.c"
     break;
 
-  case 427:
-#line 1921 "./util/configparser.y"
+  case 430:
+#line 1929 "./util/configparser.y"
         {
 		OUTYY(("P(server_add_holddown:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4935,11 +4961,11 @@ yyreduce:
 		else cfg_parser->cfg->add_holddown = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4939 "util/configparser.c"
+#line 4965 "util/configparser.c"
     break;
 
-  case 428:
-#line 1930 "./util/configparser.y"
+  case 431:
+#line 1938 "./util/configparser.y"
         {
 		OUTYY(("P(server_del_holddown:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4947,11 +4973,11 @@ yyreduce:
 		else cfg_parser->cfg->del_holddown = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4951 "util/configparser.c"
+#line 4977 "util/configparser.c"
     break;
 
-  case 429:
-#line 1939 "./util/configparser.y"
+  case 432:
+#line 1947 "./util/configparser.y"
         {
 		OUTYY(("P(server_keep_missing:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -4959,11 +4985,11 @@ yyreduce:
 		else cfg_parser->cfg->keep_missing = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 4963 "util/configparser.c"
+#line 4989 "util/configparser.c"
     break;
 
-  case 430:
-#line 1948 "./util/configparser.y"
+  case 433:
+#line 1956 "./util/configparser.y"
         {
 		OUTYY(("P(server_permit_small_holddown:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -4972,22 +4998,22 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 4976 "util/configparser.c"
+#line 5002 "util/configparser.c"
     break;
 
-  case 431:
-#line 1957 "./util/configparser.y"
+  case 434:
+#line 1965 "./util/configparser.y"
         {
 		OUTYY(("P(server_key_cache_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->key_cache_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 4987 "util/configparser.c"
+#line 5013 "util/configparser.c"
     break;
 
-  case 432:
-#line 1965 "./util/configparser.y"
+  case 435:
+#line 1973 "./util/configparser.y"
         {
 		OUTYY(("P(server_key_cache_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -4999,22 +5025,22 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 5003 "util/configparser.c"
+#line 5029 "util/configparser.c"
     break;
 
-  case 433:
-#line 1978 "./util/configparser.y"
+  case 436:
+#line 1986 "./util/configparser.y"
         {
 		OUTYY(("P(server_neg_cache_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->neg_cache_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 5014 "util/configparser.c"
+#line 5040 "util/configparser.c"
     break;
 
-  case 434:
-#line 1986 "./util/configparser.y"
+  case 437:
+#line 1994 "./util/configparser.y"
         {
 		OUTYY(("P(server_local_zone:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "static")!=0 && strcmp((yyvsp[0].str), "deny")!=0 &&
@@ -5054,21 +5080,21 @@ yyreduce:
 				fatal_exit("out of memory adding local-zone");
 		}
 	}
-#line 5058 "util/configparser.c"
+#line 5084 "util/configparser.c"
     break;
 
-  case 435:
-#line 2027 "./util/configparser.y"
+  case 438:
+#line 2035 "./util/configparser.y"
         {
 		OUTYY(("P(server_local_data:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->local_data, (yyvsp[0].str)))
 			fatal_exit("out of memory adding local-data");
 	}
-#line 5068 "util/configparser.c"
+#line 5094 "util/configparser.c"
     break;
 
-  case 436:
-#line 2034 "./util/configparser.y"
+  case 439:
+#line 2042 "./util/configparser.y"
         {
 		char* ptr;
 		OUTYY(("P(server_local_data_ptr:%s)\n", (yyvsp[0].str)));
@@ -5082,11 +5108,11 @@ yyreduce:
 			yyerror("local-data-ptr could not be reversed");
 		}
 	}
-#line 5086 "util/configparser.c"
+#line 5112 "util/configparser.c"
     break;
 
-  case 437:
-#line 2049 "./util/configparser.y"
+  case 440:
+#line 2057 "./util/configparser.y"
         {
 		OUTYY(("P(server_minimal_responses:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5095,11 +5121,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5099 "util/configparser.c"
+#line 5125 "util/configparser.c"
     break;
 
-  case 438:
-#line 2059 "./util/configparser.y"
+  case 441:
+#line 2067 "./util/configparser.y"
         {
 		OUTYY(("P(server_rrset_roundrobin:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5108,41 +5134,41 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5112 "util/configparser.c"
+#line 5138 "util/configparser.c"
     break;
 
-  case 439:
-#line 2069 "./util/configparser.y"
+  case 442:
+#line 2077 "./util/configparser.y"
         {
 		OUTYY(("P(server_unknown_server_time_limit:%s)\n", (yyvsp[0].str)));
 		cfg_parser->cfg->unknown_server_time_limit = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5122 "util/configparser.c"
+#line 5148 "util/configparser.c"
     break;
 
-  case 440:
-#line 2076 "./util/configparser.y"
+  case 443:
+#line 2084 "./util/configparser.y"
         {
 		OUTYY(("P(server_max_udp_size:%s)\n", (yyvsp[0].str)));
 		cfg_parser->cfg->max_udp_size = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5132 "util/configparser.c"
+#line 5158 "util/configparser.c"
     break;
 
-  case 441:
-#line 2083 "./util/configparser.y"
+  case 444:
+#line 2091 "./util/configparser.y"
         {
 		OUTYY(("P(dns64_prefix:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dns64_prefix);
 		cfg_parser->cfg->dns64_prefix = (yyvsp[0].str);
 	}
-#line 5142 "util/configparser.c"
+#line 5168 "util/configparser.c"
     break;
 
-  case 442:
-#line 2090 "./util/configparser.y"
+  case 445:
+#line 2098 "./util/configparser.y"
         {
 		OUTYY(("P(server_dns64_synthall:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5150,22 +5176,22 @@ yyreduce:
 		else cfg_parser->cfg->dns64_synthall = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5154 "util/configparser.c"
+#line 5180 "util/configparser.c"
     break;
 
-  case 443:
-#line 2099 "./util/configparser.y"
+  case 446:
+#line 2107 "./util/configparser.y"
         {
 		OUTYY(("P(dns64_ignore_aaaa:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dns64_ignore_aaaa,
 			(yyvsp[0].str)))
 			fatal_exit("out of memory adding dns64-ignore-aaaa");
 	}
-#line 5165 "util/configparser.c"
+#line 5191 "util/configparser.c"
     break;
 
-  case 444:
-#line 2107 "./util/configparser.y"
+  case 447:
+#line 2115 "./util/configparser.y"
         {
 		char* p, *s = (yyvsp[0].str);
 		OUTYY(("P(server_define_tag:%s)\n", (yyvsp[0].str)));
@@ -5178,11 +5204,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 5182 "util/configparser.c"
+#line 5208 "util/configparser.c"
     break;
 
-  case 445:
-#line 2121 "./util/configparser.y"
+  case 448:
+#line 2129 "./util/configparser.y"
         {
 		size_t len = 0;
 		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@ -5202,11 +5228,11 @@ yyreduce:
 			}
 		}
 	}
-#line 5206 "util/configparser.c"
+#line 5232 "util/configparser.c"
     break;
 
-  case 446:
-#line 2142 "./util/configparser.y"
+  case 449:
+#line 2150 "./util/configparser.y"
         {
 		size_t len = 0;
 		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@ -5226,11 +5252,11 @@ yyreduce:
 			}
 		}
 	}
-#line 5230 "util/configparser.c"
+#line 5256 "util/configparser.c"
     break;
 
-  case 447:
-#line 2163 "./util/configparser.y"
+  case 450:
+#line 2171 "./util/configparser.y"
         {
 		OUTYY(("P(server_access_control_tag_action:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_actions,
@@ -5241,11 +5267,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		}
 	}
-#line 5245 "util/configparser.c"
+#line 5271 "util/configparser.c"
     break;
 
-  case 448:
-#line 2175 "./util/configparser.y"
+  case 451:
+#line 2183 "./util/configparser.y"
         {
 		OUTYY(("P(server_access_control_tag_data:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_datas,
@@ -5256,11 +5282,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		}
 	}
-#line 5260 "util/configparser.c"
+#line 5286 "util/configparser.c"
     break;
 
-  case 449:
-#line 2187 "./util/configparser.y"
+  case 452:
+#line 2195 "./util/configparser.y"
         {
 		OUTYY(("P(server_local_zone_override:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str3list_insert(&cfg_parser->cfg->local_zone_overrides,
@@ -5271,11 +5297,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		}
 	}
-#line 5275 "util/configparser.c"
+#line 5301 "util/configparser.c"
     break;
 
-  case 450:
-#line 2199 "./util/configparser.y"
+  case 453:
+#line 2207 "./util/configparser.y"
         {
 		OUTYY(("P(server_access_control_view:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str2list_insert(&cfg_parser->cfg->acl_view,
@@ -5283,11 +5309,11 @@ yyreduce:
 			yyerror("out of memory");
 		}
 	}
-#line 5287 "util/configparser.c"
+#line 5313 "util/configparser.c"
     break;
 
-  case 451:
-#line 2208 "./util/configparser.y"
+  case 454:
+#line 2216 "./util/configparser.y"
         {
 		size_t len = 0;
 		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@ -5307,11 +5333,11 @@ yyreduce:
 			}
 		}
 	}
-#line 5311 "util/configparser.c"
+#line 5337 "util/configparser.c"
     break;
 
-  case 452:
-#line 2229 "./util/configparser.y"
+  case 455:
+#line 2237 "./util/configparser.y"
         { 
 		OUTYY(("P(server_ip_ratelimit:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5319,11 +5345,11 @@ yyreduce:
 		else cfg_parser->cfg->ip_ratelimit = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5323 "util/configparser.c"
+#line 5349 "util/configparser.c"
     break;
 
-  case 453:
-#line 2239 "./util/configparser.y"
+  case 456:
+#line 2247 "./util/configparser.y"
         { 
 		OUTYY(("P(server_ratelimit:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5331,33 +5357,33 @@ yyreduce:
 		else cfg_parser->cfg->ratelimit = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5335 "util/configparser.c"
+#line 5361 "util/configparser.c"
     break;
 
-  case 454:
-#line 2248 "./util/configparser.y"
+  case 457:
+#line 2256 "./util/configparser.y"
   {
   	OUTYY(("P(server_ip_ratelimit_size:%s)\n", (yyvsp[0].str)));
   	if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->ip_ratelimit_size))
   		yyerror("memory size expected");
   	free((yyvsp[0].str));
   }
-#line 5346 "util/configparser.c"
+#line 5372 "util/configparser.c"
     break;
 
-  case 455:
-#line 2256 "./util/configparser.y"
+  case 458:
+#line 2264 "./util/configparser.y"
         {
 		OUTYY(("P(server_ratelimit_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->ratelimit_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 5357 "util/configparser.c"
+#line 5383 "util/configparser.c"
     break;
 
-  case 456:
-#line 2264 "./util/configparser.y"
+  case 459:
+#line 2272 "./util/configparser.y"
   {
   	OUTYY(("P(server_ip_ratelimit_slabs:%s)\n", (yyvsp[0].str)));
   	if(atoi((yyvsp[0].str)) == 0)
@@ -5369,11 +5395,11 @@ yyreduce:
   	}
   	free((yyvsp[0].str));
   }
-#line 5373 "util/configparser.c"
+#line 5399 "util/configparser.c"
     break;
 
-  case 457:
-#line 2277 "./util/configparser.y"
+  case 460:
+#line 2285 "./util/configparser.y"
         {
 		OUTYY(("P(server_ratelimit_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -5385,11 +5411,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 5389 "util/configparser.c"
+#line 5415 "util/configparser.c"
     break;
 
-  case 458:
-#line 2290 "./util/configparser.y"
+  case 461:
+#line 2298 "./util/configparser.y"
         {
 		OUTYY(("P(server_ratelimit_for_domain:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0) {
@@ -5403,11 +5429,11 @@ yyreduce:
 					"ratelimit-for-domain");
 		}
 	}
-#line 5407 "util/configparser.c"
+#line 5433 "util/configparser.c"
     break;
 
-  case 459:
-#line 2305 "./util/configparser.y"
+  case 462:
+#line 2313 "./util/configparser.y"
         {
 		OUTYY(("P(server_ratelimit_below_domain:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0) {
@@ -5421,11 +5447,11 @@ yyreduce:
 					"ratelimit-below-domain");
 		}
 	}
-#line 5425 "util/configparser.c"
+#line 5451 "util/configparser.c"
     break;
 
-  case 460:
-#line 2320 "./util/configparser.y"
+  case 463:
+#line 2328 "./util/configparser.y"
   { 
   	OUTYY(("P(server_ip_ratelimit_factor:%s)\n", (yyvsp[0].str))); 
   	if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5433,11 +5459,11 @@ yyreduce:
   	else cfg_parser->cfg->ip_ratelimit_factor = atoi((yyvsp[0].str));
   	free((yyvsp[0].str));
 	}
-#line 5437 "util/configparser.c"
+#line 5463 "util/configparser.c"
     break;
 
-  case 461:
-#line 2329 "./util/configparser.y"
+  case 464:
+#line 2337 "./util/configparser.y"
         { 
 		OUTYY(("P(server_ratelimit_factor:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5445,20 +5471,20 @@ yyreduce:
 		else cfg_parser->cfg->ratelimit_factor = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5449 "util/configparser.c"
+#line 5475 "util/configparser.c"
     break;
 
-  case 462:
-#line 2338 "./util/configparser.y"
+  case 465:
+#line 2346 "./util/configparser.y"
         { 
 		OUTYY(("P(low-rtt option is deprecated, use fast-server-num instead)\n"));
 		free((yyvsp[0].str));
 	}
-#line 5458 "util/configparser.c"
+#line 5484 "util/configparser.c"
     break;
 
-  case 463:
-#line 2344 "./util/configparser.y"
+  case 466:
+#line 2352 "./util/configparser.y"
         { 
 		OUTYY(("P(server_fast_server_num:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) <= 0)
@@ -5466,11 +5492,11 @@ yyreduce:
 		else cfg_parser->cfg->fast_server_num = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5470 "util/configparser.c"
+#line 5496 "util/configparser.c"
     break;
 
-  case 464:
-#line 2353 "./util/configparser.y"
+  case 467:
+#line 2361 "./util/configparser.y"
         { 
 		OUTYY(("P(server_fast_server_permil:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5478,11 +5504,11 @@ yyreduce:
 		else cfg_parser->cfg->fast_server_permil = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5482 "util/configparser.c"
+#line 5508 "util/configparser.c"
     break;
 
-  case 465:
-#line 2362 "./util/configparser.y"
+  case 468:
+#line 2370 "./util/configparser.y"
         {
 		OUTYY(("P(server_qname_minimisation:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5491,11 +5517,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5495 "util/configparser.c"
+#line 5521 "util/configparser.c"
     break;
 
-  case 466:
-#line 2372 "./util/configparser.y"
+  case 469:
+#line 2380 "./util/configparser.y"
         {
 		OUTYY(("P(server_qname_minimisation_strict:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5504,11 +5530,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5508 "util/configparser.c"
+#line 5534 "util/configparser.c"
     break;
 
-  case 467:
-#line 2382 "./util/configparser.y"
+  case 470:
+#line 2390 "./util/configparser.y"
         {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_enabled:%s)\n", (yyvsp[0].str)));
@@ -5520,11 +5546,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 5524 "util/configparser.c"
+#line 5550 "util/configparser.c"
     break;
 
-  case 468:
-#line 2395 "./util/configparser.y"
+  case 471:
+#line 2403 "./util/configparser.y"
         {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_ignore_bogus:%s)\n", (yyvsp[0].str)));
@@ -5536,11 +5562,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 5540 "util/configparser.c"
+#line 5566 "util/configparser.c"
     break;
 
-  case 469:
-#line 2408 "./util/configparser.y"
+  case 472:
+#line 2416 "./util/configparser.y"
         {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_hook:%s)\n", (yyvsp[0].str)));
@@ -5551,11 +5577,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5555 "util/configparser.c"
+#line 5581 "util/configparser.c"
     break;
 
-  case 470:
-#line 2420 "./util/configparser.y"
+  case 473:
+#line 2428 "./util/configparser.y"
         {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_max_ttl:%s)\n", (yyvsp[0].str)));
@@ -5568,11 +5594,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5572 "util/configparser.c"
+#line 5598 "util/configparser.c"
     break;
 
-  case 471:
-#line 2434 "./util/configparser.y"
+  case 474:
+#line 2442 "./util/configparser.y"
         {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_whitelist:%s)\n", (yyvsp[0].str)));
@@ -5583,11 +5609,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5587 "util/configparser.c"
+#line 5613 "util/configparser.c"
     break;
 
-  case 472:
-#line 2446 "./util/configparser.y"
+  case 475:
+#line 2454 "./util/configparser.y"
         {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_strict:%s)\n", (yyvsp[0].str)));
@@ -5600,11 +5626,29 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5604 "util/configparser.c"
+#line 5630 "util/configparser.c"
     break;
 
-  case 473:
-#line 2460 "./util/configparser.y"
+  case 476:
+#line 2468 "./util/configparser.y"
+        {
+		int tag_data;
+		OUTYY(("P(server_edns_client_tag:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
+		tag_data = atoi((yyvsp[0].str));
+		if(tag_data > 65535 || tag_data < 0 ||
+			(tag_data == 0 && (strlen((yyvsp[0].str)) != 1 || (yyvsp[0].str)[0] != '0')))
+			yyerror("edns-client-tag data invalid, needs to be a "
+				"number from 0 to 65535");
+		if(!cfg_str2list_insert(
+			&cfg_parser->cfg->edns_client_tags, (yyvsp[-1].str), (yyvsp[0].str)))
+			fatal_exit("out of memory adding "
+				"edns-client-tag");
+	}
+#line 5648 "util/configparser.c"
+    break;
+
+  case 477:
+#line 2483 "./util/configparser.y"
         {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->stubs->name)
@@ -5613,31 +5657,31 @@ yyreduce:
 		free(cfg_parser->cfg->stubs->name);
 		cfg_parser->cfg->stubs->name = (yyvsp[0].str);
 	}
-#line 5617 "util/configparser.c"
+#line 5661 "util/configparser.c"
     break;
 
-  case 474:
-#line 2470 "./util/configparser.y"
+  case 478:
+#line 2493 "./util/configparser.y"
         {
 		OUTYY(("P(stub-host:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->hosts, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5627 "util/configparser.c"
+#line 5671 "util/configparser.c"
     break;
 
-  case 475:
-#line 2477 "./util/configparser.y"
+  case 479:
+#line 2500 "./util/configparser.y"
         {
 		OUTYY(("P(stub-addr:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->addrs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5637 "util/configparser.c"
+#line 5681 "util/configparser.c"
     break;
 
-  case 476:
-#line 2484 "./util/configparser.y"
+  case 480:
+#line 2507 "./util/configparser.y"
         {
 		OUTYY(("P(stub-first:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5645,11 +5689,11 @@ yyreduce:
 		else cfg_parser->cfg->stubs->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5649 "util/configparser.c"
+#line 5693 "util/configparser.c"
     break;
 
-  case 477:
-#line 2493 "./util/configparser.y"
+  case 481:
+#line 2516 "./util/configparser.y"
         {
 		OUTYY(("P(stub-no-cache:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5657,11 +5701,11 @@ yyreduce:
 		else cfg_parser->cfg->stubs->no_cache=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5661 "util/configparser.c"
+#line 5705 "util/configparser.c"
     break;
 
-  case 478:
-#line 2502 "./util/configparser.y"
+  case 482:
+#line 2525 "./util/configparser.y"
         {
 		OUTYY(("P(stub-ssl-upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5670,11 +5714,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5674 "util/configparser.c"
+#line 5718 "util/configparser.c"
     break;
 
-  case 479:
-#line 2512 "./util/configparser.y"
+  case 483:
+#line 2535 "./util/configparser.y"
         {
 		OUTYY(("P(stub-prime:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5683,11 +5727,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5687 "util/configparser.c"
+#line 5731 "util/configparser.c"
     break;
 
-  case 480:
-#line 2522 "./util/configparser.y"
+  case 484:
+#line 2545 "./util/configparser.y"
         {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->forwards->name)
@@ -5696,31 +5740,31 @@ yyreduce:
 		free(cfg_parser->cfg->forwards->name);
 		cfg_parser->cfg->forwards->name = (yyvsp[0].str);
 	}
-#line 5700 "util/configparser.c"
+#line 5744 "util/configparser.c"
     break;
 
-  case 481:
-#line 2532 "./util/configparser.y"
+  case 485:
+#line 2555 "./util/configparser.y"
         {
 		OUTYY(("P(forward-host:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->hosts, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5710 "util/configparser.c"
+#line 5754 "util/configparser.c"
     break;
 
-  case 482:
-#line 2539 "./util/configparser.y"
+  case 486:
+#line 2562 "./util/configparser.y"
         {
 		OUTYY(("P(forward-addr:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->addrs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5720 "util/configparser.c"
+#line 5764 "util/configparser.c"
     break;
 
-  case 483:
-#line 2546 "./util/configparser.y"
+  case 487:
+#line 2569 "./util/configparser.y"
         {
 		OUTYY(("P(forward-first:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5728,11 +5772,11 @@ yyreduce:
 		else cfg_parser->cfg->forwards->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5732 "util/configparser.c"
+#line 5776 "util/configparser.c"
     break;
 
-  case 484:
-#line 2555 "./util/configparser.y"
+  case 488:
+#line 2578 "./util/configparser.y"
         {
 		OUTYY(("P(forward-no-cache:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5740,11 +5784,11 @@ yyreduce:
 		else cfg_parser->cfg->forwards->no_cache=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5744 "util/configparser.c"
+#line 5788 "util/configparser.c"
     break;
 
-  case 485:
-#line 2564 "./util/configparser.y"
+  case 489:
+#line 2587 "./util/configparser.y"
         {
 		OUTYY(("P(forward-ssl-upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5753,11 +5797,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5757 "util/configparser.c"
+#line 5801 "util/configparser.c"
     break;
 
-  case 486:
-#line 2574 "./util/configparser.y"
+  case 490:
+#line 2597 "./util/configparser.y"
         {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->auths->name)
@@ -5766,52 +5810,52 @@ yyreduce:
 		free(cfg_parser->cfg->auths->name);
 		cfg_parser->cfg->auths->name = (yyvsp[0].str);
 	}
-#line 5770 "util/configparser.c"
+#line 5814 "util/configparser.c"
     break;
 
-  case 487:
-#line 2584 "./util/configparser.y"
+  case 491:
+#line 2607 "./util/configparser.y"
         {
 		OUTYY(("P(zonefile:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->auths->zonefile);
 		cfg_parser->cfg->auths->zonefile = (yyvsp[0].str);
 	}
-#line 5780 "util/configparser.c"
+#line 5824 "util/configparser.c"
     break;
 
-  case 488:
-#line 2591 "./util/configparser.y"
+  case 492:
+#line 2614 "./util/configparser.y"
         {
 		OUTYY(("P(master:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->auths->masters, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5790 "util/configparser.c"
+#line 5834 "util/configparser.c"
     break;
 
-  case 489:
-#line 2598 "./util/configparser.y"
+  case 493:
+#line 2621 "./util/configparser.y"
         {
 		OUTYY(("P(url:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->auths->urls, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5800 "util/configparser.c"
+#line 5844 "util/configparser.c"
     break;
 
-  case 490:
-#line 2605 "./util/configparser.y"
+  case 494:
+#line 2628 "./util/configparser.y"
         {
 		OUTYY(("P(allow-notify:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->auths->allow_notify,
 			(yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5811 "util/configparser.c"
+#line 5855 "util/configparser.c"
     break;
 
-  case 491:
-#line 2613 "./util/configparser.y"
+  case 495:
+#line 2636 "./util/configparser.y"
         {
 		OUTYY(("P(for-downstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5820,11 +5864,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5824 "util/configparser.c"
+#line 5868 "util/configparser.c"
     break;
 
-  case 492:
-#line 2623 "./util/configparser.y"
+  case 496:
+#line 2646 "./util/configparser.y"
         {
 		OUTYY(("P(for-upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5833,11 +5877,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5837 "util/configparser.c"
+#line 5881 "util/configparser.c"
     break;
 
-  case 493:
-#line 2633 "./util/configparser.y"
+  case 497:
+#line 2656 "./util/configparser.y"
         {
 		OUTYY(("P(fallback-enabled:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5846,11 +5890,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5850 "util/configparser.c"
+#line 5894 "util/configparser.c"
     break;
 
-  case 494:
-#line 2643 "./util/configparser.y"
+  case 498:
+#line 2666 "./util/configparser.y"
         {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->views->name)
@@ -5859,11 +5903,11 @@ yyreduce:
 		free(cfg_parser->cfg->views->name);
 		cfg_parser->cfg->views->name = (yyvsp[0].str);
 	}
-#line 5863 "util/configparser.c"
+#line 5907 "util/configparser.c"
     break;
 
-  case 495:
-#line 2653 "./util/configparser.y"
+  case 499:
+#line 2676 "./util/configparser.y"
         {
 		OUTYY(("P(view_local_zone:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "static")!=0 && strcmp((yyvsp[0].str), "deny")!=0 &&
@@ -5901,11 +5945,11 @@ yyreduce:
 				fatal_exit("out of memory adding local-zone");
 		}
 	}
-#line 5905 "util/configparser.c"
+#line 5949 "util/configparser.c"
     break;
 
-  case 496:
-#line 2692 "./util/configparser.y"
+  case 500:
+#line 2715 "./util/configparser.y"
         {
 		OUTYY(("P(view_response_ip:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		validate_respip_action((yyvsp[0].str));
@@ -5914,33 +5958,33 @@ yyreduce:
 			fatal_exit("out of memory adding per-view "
 				"response-ip action");
 	}
-#line 5918 "util/configparser.c"
+#line 5962 "util/configparser.c"
     break;
 
-  case 497:
-#line 2702 "./util/configparser.y"
+  case 501:
+#line 2725 "./util/configparser.y"
         {
 		OUTYY(("P(view_response_ip_data:%s)\n", (yyvsp[-1].str)));
 		if(!cfg_str2list_insert(
 			&cfg_parser->cfg->views->respip_data, (yyvsp[-1].str), (yyvsp[0].str)))
 			fatal_exit("out of memory adding response-ip-data");
 	}
-#line 5929 "util/configparser.c"
+#line 5973 "util/configparser.c"
     break;
 
-  case 498:
-#line 2710 "./util/configparser.y"
+  case 502:
+#line 2733 "./util/configparser.y"
         {
 		OUTYY(("P(view_local_data:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->views->local_data, (yyvsp[0].str))) {
 			fatal_exit("out of memory adding local-data");
 		}
 	}
-#line 5940 "util/configparser.c"
+#line 5984 "util/configparser.c"
     break;
 
-  case 499:
-#line 2718 "./util/configparser.y"
+  case 503:
+#line 2741 "./util/configparser.y"
         {
 		char* ptr;
 		OUTYY(("P(view_local_data_ptr:%s)\n", (yyvsp[0].str)));
@@ -5954,11 +5998,11 @@ yyreduce:
 			yyerror("local-data-ptr could not be reversed");
 		}
 	}
-#line 5958 "util/configparser.c"
+#line 6002 "util/configparser.c"
     break;
 
-  case 500:
-#line 2733 "./util/configparser.y"
+  case 504:
+#line 2756 "./util/configparser.y"
         {
 		OUTYY(("P(view-first:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5966,19 +6010,19 @@ yyreduce:
 		else cfg_parser->cfg->views->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5970 "util/configparser.c"
+#line 6014 "util/configparser.c"
     break;
 
-  case 501:
-#line 2742 "./util/configparser.y"
+  case 505:
+#line 2765 "./util/configparser.y"
         { 
 		OUTYY(("\nP(remote-control:)\n")); 
 	}
-#line 5978 "util/configparser.c"
+#line 6022 "util/configparser.c"
     break;
 
-  case 512:
-#line 2753 "./util/configparser.y"
+  case 516:
+#line 2776 "./util/configparser.y"
         {
 		OUTYY(("P(control_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5987,11 +6031,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5991 "util/configparser.c"
+#line 6035 "util/configparser.c"
     break;
 
-  case 513:
-#line 2763 "./util/configparser.y"
+  case 517:
+#line 2786 "./util/configparser.y"
         {
 		OUTYY(("P(control_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -5999,79 +6043,79 @@ yyreduce:
 		else cfg_parser->cfg->control_port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 6003 "util/configparser.c"
+#line 6047 "util/configparser.c"
     break;
 
-  case 514:
-#line 2772 "./util/configparser.y"
+  case 518:
+#line 2795 "./util/configparser.y"
         {
 		OUTYY(("P(control_interface:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_append(&cfg_parser->cfg->control_ifs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 6013 "util/configparser.c"
+#line 6057 "util/configparser.c"
     break;
 
-  case 515:
-#line 2779 "./util/configparser.y"
+  case 519:
+#line 2802 "./util/configparser.y"
         {
 		OUTYY(("P(control_use_cert:%s)\n", (yyvsp[0].str)));
 		cfg_parser->cfg->control_use_cert = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6023 "util/configparser.c"
+#line 6067 "util/configparser.c"
     break;
 
-  case 516:
-#line 2786 "./util/configparser.y"
+  case 520:
+#line 2809 "./util/configparser.y"
         {
 		OUTYY(("P(rc_server_key_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->server_key_file);
 		cfg_parser->cfg->server_key_file = (yyvsp[0].str);
 	}
-#line 6033 "util/configparser.c"
+#line 6077 "util/configparser.c"
     break;
 
-  case 517:
-#line 2793 "./util/configparser.y"
+  case 521:
+#line 2816 "./util/configparser.y"
         {
 		OUTYY(("P(rc_server_cert_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->server_cert_file);
 		cfg_parser->cfg->server_cert_file = (yyvsp[0].str);
 	}
-#line 6043 "util/configparser.c"
+#line 6087 "util/configparser.c"
     break;
 
-  case 518:
-#line 2800 "./util/configparser.y"
+  case 522:
+#line 2823 "./util/configparser.y"
         {
 		OUTYY(("P(rc_control_key_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->control_key_file);
 		cfg_parser->cfg->control_key_file = (yyvsp[0].str);
 	}
-#line 6053 "util/configparser.c"
+#line 6097 "util/configparser.c"
     break;
 
-  case 519:
-#line 2807 "./util/configparser.y"
+  case 523:
+#line 2830 "./util/configparser.y"
         {
 		OUTYY(("P(rc_control_cert_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->control_cert_file);
 		cfg_parser->cfg->control_cert_file = (yyvsp[0].str);
 	}
-#line 6063 "util/configparser.c"
+#line 6107 "util/configparser.c"
     break;
 
-  case 520:
-#line 2814 "./util/configparser.y"
+  case 524:
+#line 2837 "./util/configparser.y"
         {
 		OUTYY(("\nP(dnstap:)\n"));
 	}
-#line 6071 "util/configparser.c"
+#line 6115 "util/configparser.c"
     break;
 
-  case 541:
-#line 2834 "./util/configparser.y"
+  case 546:
+#line 2857 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6079,31 +6123,44 @@ yyreduce:
 		else cfg_parser->cfg->dnstap = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6083 "util/configparser.c"
+#line 6127 "util/configparser.c"
     break;
 
-  case 542:
-#line 2843 "./util/configparser.y"
+  case 547:
+#line 2866 "./util/configparser.y"
+        {
+		OUTYY(("P(dt_dnstap_bidirectional:%s)\n", (yyvsp[0].str)));
+		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->dnstap_bidirectional =
+			(strcmp((yyvsp[0].str), "yes")==0);
+		free((yyvsp[0].str));
+	}
+#line 6140 "util/configparser.c"
+    break;
+
+  case 548:
+#line 2876 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_socket_path:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_socket_path);
 		cfg_parser->cfg->dnstap_socket_path = (yyvsp[0].str);
 	}
-#line 6093 "util/configparser.c"
+#line 6150 "util/configparser.c"
     break;
 
-  case 543:
-#line 2850 "./util/configparser.y"
+  case 549:
+#line 2883 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_ip:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_ip);
 		cfg_parser->cfg->dnstap_ip = (yyvsp[0].str);
 	}
-#line 6103 "util/configparser.c"
+#line 6160 "util/configparser.c"
     break;
 
-  case 544:
-#line 2857 "./util/configparser.y"
+  case 550:
+#line 2890 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_tls:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6111,51 +6168,51 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_tls = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6115 "util/configparser.c"
+#line 6172 "util/configparser.c"
     break;
 
-  case 545:
-#line 2866 "./util/configparser.y"
+  case 551:
+#line 2899 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_tls_server_name:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_tls_server_name);
 		cfg_parser->cfg->dnstap_tls_server_name = (yyvsp[0].str);
 	}
-#line 6125 "util/configparser.c"
+#line 6182 "util/configparser.c"
     break;
 
-  case 546:
-#line 2873 "./util/configparser.y"
+  case 552:
+#line 2906 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_tls_cert_bundle:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_tls_cert_bundle);
 		cfg_parser->cfg->dnstap_tls_cert_bundle = (yyvsp[0].str);
 	}
-#line 6135 "util/configparser.c"
+#line 6192 "util/configparser.c"
     break;
 
-  case 547:
-#line 2880 "./util/configparser.y"
+  case 553:
+#line 2913 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_tls_client_key_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_tls_client_key_file);
 		cfg_parser->cfg->dnstap_tls_client_key_file = (yyvsp[0].str);
 	}
-#line 6145 "util/configparser.c"
+#line 6202 "util/configparser.c"
     break;
 
-  case 548:
-#line 2887 "./util/configparser.y"
+  case 554:
+#line 2920 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_tls_client_cert_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_tls_client_cert_file);
 		cfg_parser->cfg->dnstap_tls_client_cert_file = (yyvsp[0].str);
 	}
-#line 6155 "util/configparser.c"
+#line 6212 "util/configparser.c"
     break;
 
-  case 549:
-#line 2894 "./util/configparser.y"
+  case 555:
+#line 2927 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_send_identity:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6163,11 +6220,11 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_send_identity = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6167 "util/configparser.c"
+#line 6224 "util/configparser.c"
     break;
 
-  case 550:
-#line 2903 "./util/configparser.y"
+  case 556:
+#line 2936 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_send_version:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6175,31 +6232,31 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_send_version = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6179 "util/configparser.c"
+#line 6236 "util/configparser.c"
     break;
 
-  case 551:
-#line 2912 "./util/configparser.y"
+  case 557:
+#line 2945 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_identity:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_identity);
 		cfg_parser->cfg->dnstap_identity = (yyvsp[0].str);
 	}
-#line 6189 "util/configparser.c"
+#line 6246 "util/configparser.c"
     break;
 
-  case 552:
-#line 2919 "./util/configparser.y"
+  case 558:
+#line 2952 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_version:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_version);
 		cfg_parser->cfg->dnstap_version = (yyvsp[0].str);
 	}
-#line 6199 "util/configparser.c"
+#line 6256 "util/configparser.c"
     break;
 
-  case 553:
-#line 2926 "./util/configparser.y"
+  case 559:
+#line 2959 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_log_resolver_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6208,11 +6265,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6212 "util/configparser.c"
+#line 6269 "util/configparser.c"
     break;
 
-  case 554:
-#line 2936 "./util/configparser.y"
+  case 560:
+#line 2969 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_log_resolver_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6221,11 +6278,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6225 "util/configparser.c"
+#line 6282 "util/configparser.c"
     break;
 
-  case 555:
-#line 2946 "./util/configparser.y"
+  case 561:
+#line 2979 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_log_client_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6234,11 +6291,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6238 "util/configparser.c"
+#line 6295 "util/configparser.c"
     break;
 
-  case 556:
-#line 2956 "./util/configparser.y"
+  case 562:
+#line 2989 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_log_client_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6247,11 +6304,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6251 "util/configparser.c"
+#line 6308 "util/configparser.c"
     break;
 
-  case 557:
-#line 2966 "./util/configparser.y"
+  case 563:
+#line 2999 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_log_forwarder_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6260,11 +6317,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6264 "util/configparser.c"
+#line 6321 "util/configparser.c"
     break;
 
-  case 558:
-#line 2976 "./util/configparser.y"
+  case 564:
+#line 3009 "./util/configparser.y"
         {
 		OUTYY(("P(dt_dnstap_log_forwarder_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6273,47 +6330,47 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6277 "util/configparser.c"
+#line 6334 "util/configparser.c"
     break;
 
-  case 559:
-#line 2986 "./util/configparser.y"
+  case 565:
+#line 3019 "./util/configparser.y"
         { 
 		OUTYY(("\nP(python:)\n")); 
 	}
-#line 6285 "util/configparser.c"
+#line 6342 "util/configparser.c"
     break;
 
-  case 563:
-#line 2995 "./util/configparser.y"
+  case 569:
+#line 3028 "./util/configparser.y"
         {
 		OUTYY(("P(python-script:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_append_ex(&cfg_parser->cfg->python_script, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 6295 "util/configparser.c"
+#line 6352 "util/configparser.c"
     break;
 
-  case 564:
-#line 3001 "./util/configparser.y"
+  case 570:
+#line 3034 "./util/configparser.y"
         { 
 		OUTYY(("\nP(dynlib:)\n")); 
 	}
-#line 6303 "util/configparser.c"
+#line 6360 "util/configparser.c"
     break;
 
-  case 568:
-#line 3010 "./util/configparser.y"
+  case 574:
+#line 3043 "./util/configparser.y"
         {
 		OUTYY(("P(dynlib-file:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_append_ex(&cfg_parser->cfg->dynlib_file, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 6313 "util/configparser.c"
+#line 6370 "util/configparser.c"
     break;
 
-  case 569:
-#line 3016 "./util/configparser.y"
+  case 575:
+#line 3049 "./util/configparser.y"
         {
 		OUTYY(("P(disable_dnssec_lame_check:%s)\n", (yyvsp[0].str)));
 		if (strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6322,21 +6379,21 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6326 "util/configparser.c"
+#line 6383 "util/configparser.c"
     break;
 
-  case 570:
-#line 3026 "./util/configparser.y"
+  case 576:
+#line 3059 "./util/configparser.y"
         {
 		OUTYY(("P(server_log_identity:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->log_identity);
 		cfg_parser->cfg->log_identity = (yyvsp[0].str);
 	}
-#line 6336 "util/configparser.c"
+#line 6393 "util/configparser.c"
     break;
 
-  case 571:
-#line 3033 "./util/configparser.y"
+  case 577:
+#line 3066 "./util/configparser.y"
         {
 		OUTYY(("P(server_response_ip:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		validate_respip_action((yyvsp[0].str));
@@ -6344,30 +6401,30 @@ yyreduce:
 			(yyvsp[-1].str), (yyvsp[0].str)))
 			fatal_exit("out of memory adding response-ip");
 	}
-#line 6348 "util/configparser.c"
+#line 6405 "util/configparser.c"
     break;
 
-  case 572:
-#line 3042 "./util/configparser.y"
+  case 578:
+#line 3075 "./util/configparser.y"
         {
 		OUTYY(("P(server_response_ip_data:%s)\n", (yyvsp[-1].str)));
 		if(!cfg_str2list_insert(&cfg_parser->cfg->respip_data,
 			(yyvsp[-1].str), (yyvsp[0].str)))
 			fatal_exit("out of memory adding response-ip-data");
 	}
-#line 6359 "util/configparser.c"
+#line 6416 "util/configparser.c"
     break;
 
-  case 573:
-#line 3050 "./util/configparser.y"
+  case 579:
+#line 3083 "./util/configparser.y"
         {
 		OUTYY(("\nP(dnscrypt:)\n"));
 	}
-#line 6367 "util/configparser.c"
+#line 6424 "util/configparser.c"
     break;
 
-  case 586:
-#line 3066 "./util/configparser.y"
+  case 592:
+#line 3099 "./util/configparser.y"
         {
 		OUTYY(("P(dnsc_dnscrypt_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6375,11 +6432,11 @@ yyreduce:
 		else cfg_parser->cfg->dnscrypt = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6379 "util/configparser.c"
+#line 6436 "util/configparser.c"
     break;
 
-  case 587:
-#line 3076 "./util/configparser.y"
+  case 593:
+#line 3109 "./util/configparser.y"
         {
 		OUTYY(("P(dnsc_dnscrypt_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -6387,21 +6444,21 @@ yyreduce:
 		else cfg_parser->cfg->dnscrypt_port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 6391 "util/configparser.c"
+#line 6448 "util/configparser.c"
     break;
 
-  case 588:
-#line 3085 "./util/configparser.y"
+  case 594:
+#line 3118 "./util/configparser.y"
         {
 		OUTYY(("P(dnsc_dnscrypt_provider:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnscrypt_provider);
 		cfg_parser->cfg->dnscrypt_provider = (yyvsp[0].str);
 	}
-#line 6401 "util/configparser.c"
+#line 6458 "util/configparser.c"
     break;
 
-  case 589:
-#line 3092 "./util/configparser.y"
+  case 595:
+#line 3125 "./util/configparser.y"
         {
 		OUTYY(("P(dnsc_dnscrypt_provider_cert:%s)\n", (yyvsp[0].str)));
 		if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_provider_cert, (yyvsp[0].str)))
@@ -6409,21 +6466,21 @@ yyreduce:
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_provider_cert, (yyvsp[0].str)))
 			fatal_exit("out of memory adding dnscrypt-provider-cert");
 	}
-#line 6413 "util/configparser.c"
+#line 6470 "util/configparser.c"
     break;
 
-  case 590:
-#line 3101 "./util/configparser.y"
+  case 596:
+#line 3134 "./util/configparser.y"
         {
 		OUTYY(("P(dnsc_dnscrypt_provider_cert_rotated:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_provider_cert_rotated, (yyvsp[0].str)))
 			fatal_exit("out of memory adding dnscrypt-provider-cert-rotated");
 	}
-#line 6423 "util/configparser.c"
+#line 6480 "util/configparser.c"
     break;
 
-  case 591:
-#line 3108 "./util/configparser.y"
+  case 597:
+#line 3141 "./util/configparser.y"
         {
 		OUTYY(("P(dnsc_dnscrypt_secret_key:%s)\n", (yyvsp[0].str)));
 		if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_secret_key, (yyvsp[0].str)))
@@ -6431,22 +6488,22 @@ yyreduce:
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_secret_key, (yyvsp[0].str)))
 			fatal_exit("out of memory adding dnscrypt-secret-key");
 	}
-#line 6435 "util/configparser.c"
+#line 6492 "util/configparser.c"
     break;
 
-  case 592:
-#line 3117 "./util/configparser.y"
+  case 598:
+#line 3150 "./util/configparser.y"
   {
   	OUTYY(("P(dnscrypt_shared_secret_cache_size:%s)\n", (yyvsp[0].str)));
   	if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->dnscrypt_shared_secret_cache_size))
   		yyerror("memory size expected");
   	free((yyvsp[0].str));
   }
-#line 6446 "util/configparser.c"
+#line 6503 "util/configparser.c"
     break;
 
-  case 593:
-#line 3125 "./util/configparser.y"
+  case 599:
+#line 3158 "./util/configparser.y"
   {
   	OUTYY(("P(dnscrypt_shared_secret_cache_slabs:%s)\n", (yyvsp[0].str)));
   	if(atoi((yyvsp[0].str)) == 0)
@@ -6458,22 +6515,22 @@ yyreduce:
   	}
   	free((yyvsp[0].str));
   }
-#line 6462 "util/configparser.c"
+#line 6519 "util/configparser.c"
     break;
 
-  case 594:
-#line 3138 "./util/configparser.y"
+  case 600:
+#line 3171 "./util/configparser.y"
   {
   	OUTYY(("P(dnscrypt_nonce_cache_size:%s)\n", (yyvsp[0].str)));
   	if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->dnscrypt_nonce_cache_size))
   		yyerror("memory size expected");
   	free((yyvsp[0].str));
   }
-#line 6473 "util/configparser.c"
+#line 6530 "util/configparser.c"
     break;
 
-  case 595:
-#line 3146 "./util/configparser.y"
+  case 601:
+#line 3179 "./util/configparser.y"
   {
   	OUTYY(("P(dnscrypt_nonce_cache_slabs:%s)\n", (yyvsp[0].str)));
   	if(atoi((yyvsp[0].str)) == 0)
@@ -6485,19 +6542,19 @@ yyreduce:
   	}
   	free((yyvsp[0].str));
   }
-#line 6489 "util/configparser.c"
+#line 6546 "util/configparser.c"
     break;
 
-  case 596:
-#line 3159 "./util/configparser.y"
+  case 602:
+#line 3192 "./util/configparser.y"
         {
 		OUTYY(("\nP(cachedb:)\n"));
 	}
-#line 6497 "util/configparser.c"
+#line 6554 "util/configparser.c"
     break;
 
-  case 605:
-#line 3170 "./util/configparser.y"
+  case 611:
+#line 3203 "./util/configparser.y"
         {
 	#ifdef USE_CACHEDB
 		OUTYY(("P(backend:%s)\n", (yyvsp[0].str)));
@@ -6508,11 +6565,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 6512 "util/configparser.c"
+#line 6569 "util/configparser.c"
     break;
 
-  case 606:
-#line 3182 "./util/configparser.y"
+  case 612:
+#line 3215 "./util/configparser.y"
         {
 	#ifdef USE_CACHEDB
 		OUTYY(("P(secret-seed:%s)\n", (yyvsp[0].str)));
@@ -6523,11 +6580,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 6527 "util/configparser.c"
+#line 6584 "util/configparser.c"
     break;
 
-  case 607:
-#line 3194 "./util/configparser.y"
+  case 613:
+#line 3227 "./util/configparser.y"
         {
 	#if defined(USE_CACHEDB) && defined(USE_REDIS)
 		OUTYY(("P(redis_server_host:%s)\n", (yyvsp[0].str)));
@@ -6538,11 +6595,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 6542 "util/configparser.c"
+#line 6599 "util/configparser.c"
     break;
 
-  case 608:
-#line 3206 "./util/configparser.y"
+  case 614:
+#line 3239 "./util/configparser.y"
         {
 	#if defined(USE_CACHEDB) && defined(USE_REDIS)
 		int port;
@@ -6556,11 +6613,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 6560 "util/configparser.c"
+#line 6617 "util/configparser.c"
     break;
 
-  case 609:
-#line 3221 "./util/configparser.y"
+  case 615:
+#line 3254 "./util/configparser.y"
         {
 	#if defined(USE_CACHEDB) && defined(USE_REDIS)
 		OUTYY(("P(redis_timeout:%s)\n", (yyvsp[0].str)));
@@ -6572,11 +6629,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 6576 "util/configparser.c"
+#line 6633 "util/configparser.c"
     break;
 
-  case 610:
-#line 3234 "./util/configparser.y"
+  case 616:
+#line 3267 "./util/configparser.y"
         {
 	#if defined(USE_CACHEDB) && defined(USE_REDIS)
 		OUTYY(("P(redis_expire_records:%s)\n", (yyvsp[0].str)));
@@ -6588,11 +6645,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 6592 "util/configparser.c"
+#line 6649 "util/configparser.c"
     break;
 
-  case 611:
-#line 3247 "./util/configparser.y"
+  case 617:
+#line 3280 "./util/configparser.y"
         {
 		OUTYY(("P(server_tcp_connection_limit:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if (atoi((yyvsp[0].str)) < 0)
@@ -6602,19 +6659,19 @@ yyreduce:
 				fatal_exit("out of memory adding tcp connection limit");
 		}
 	}
-#line 6606 "util/configparser.c"
+#line 6663 "util/configparser.c"
     break;
 
-  case 612:
-#line 3258 "./util/configparser.y"
+  case 618:
+#line 3291 "./util/configparser.y"
                 {
 			OUTYY(("\nP(ipset:)\n"));
 		}
-#line 6614 "util/configparser.c"
+#line 6671 "util/configparser.c"
     break;
 
-  case 617:
-#line 3267 "./util/configparser.y"
+  case 623:
+#line 3300 "./util/configparser.y"
                 {
 		#ifdef USE_IPSET
 			OUTYY(("P(name-v4:%s)\n", (yyvsp[0].str)));
@@ -6628,11 +6685,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		#endif
 		}
-#line 6632 "util/configparser.c"
+#line 6689 "util/configparser.c"
     break;
 
-  case 618:
-#line 3282 "./util/configparser.y"
+  case 624:
+#line 3315 "./util/configparser.y"
         {
 		#ifdef USE_IPSET
 			OUTYY(("P(name-v6:%s)\n", (yyvsp[0].str)));
@@ -6646,11 +6703,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		#endif
 		}
-#line 6650 "util/configparser.c"
+#line 6707 "util/configparser.c"
     break;
 
 
-#line 6654 "util/configparser.c"
+#line 6711 "util/configparser.c"
 
       default: break;
     }
@@ -6882,7 +6939,7 @@ yyreturn:
 #endif
   return yyresult;
 }
-#line 3296 "./util/configparser.y"
+#line 3329 "./util/configparser.y"
 
 
 /* parse helper routines could be here */
diff --git a/util/configparser.h b/util/configparser.h
index 0bab3eab3..eb576e91d 100644
--- a/util/configparser.h
+++ b/util/configparser.h
@@ -57,291 +57,294 @@ extern int yydebug;
     ANY = 263,
     ZONESTR = 264,
     STRING_ARG = 265,
-    VAR_SERVER = 266,
-    VAR_VERBOSITY = 267,
-    VAR_NUM_THREADS = 268,
-    VAR_PORT = 269,
-    VAR_OUTGOING_RANGE = 270,
-    VAR_INTERFACE = 271,
-    VAR_PREFER_IP4 = 272,
-    VAR_DO_IP4 = 273,
-    VAR_DO_IP6 = 274,
-    VAR_PREFER_IP6 = 275,
-    VAR_DO_UDP = 276,
-    VAR_DO_TCP = 277,
-    VAR_TCP_MSS = 278,
-    VAR_OUTGOING_TCP_MSS = 279,
-    VAR_TCP_IDLE_TIMEOUT = 280,
-    VAR_EDNS_TCP_KEEPALIVE = 281,
-    VAR_EDNS_TCP_KEEPALIVE_TIMEOUT = 282,
-    VAR_CHROOT = 283,
-    VAR_USERNAME = 284,
-    VAR_DIRECTORY = 285,
-    VAR_LOGFILE = 286,
-    VAR_PIDFILE = 287,
-    VAR_MSG_CACHE_SIZE = 288,
-    VAR_MSG_CACHE_SLABS = 289,
-    VAR_NUM_QUERIES_PER_THREAD = 290,
-    VAR_RRSET_CACHE_SIZE = 291,
-    VAR_RRSET_CACHE_SLABS = 292,
-    VAR_OUTGOING_NUM_TCP = 293,
-    VAR_INFRA_HOST_TTL = 294,
-    VAR_INFRA_LAME_TTL = 295,
-    VAR_INFRA_CACHE_SLABS = 296,
-    VAR_INFRA_CACHE_NUMHOSTS = 297,
-    VAR_INFRA_CACHE_LAME_SIZE = 298,
-    VAR_NAME = 299,
-    VAR_STUB_ZONE = 300,
-    VAR_STUB_HOST = 301,
-    VAR_STUB_ADDR = 302,
-    VAR_TARGET_FETCH_POLICY = 303,
-    VAR_HARDEN_SHORT_BUFSIZE = 304,
-    VAR_HARDEN_LARGE_QUERIES = 305,
-    VAR_FORWARD_ZONE = 306,
-    VAR_FORWARD_HOST = 307,
-    VAR_FORWARD_ADDR = 308,
-    VAR_DO_NOT_QUERY_ADDRESS = 309,
-    VAR_HIDE_IDENTITY = 310,
-    VAR_HIDE_VERSION = 311,
-    VAR_IDENTITY = 312,
-    VAR_VERSION = 313,
-    VAR_HARDEN_GLUE = 314,
-    VAR_MODULE_CONF = 315,
-    VAR_TRUST_ANCHOR_FILE = 316,
-    VAR_TRUST_ANCHOR = 317,
-    VAR_VAL_OVERRIDE_DATE = 318,
-    VAR_BOGUS_TTL = 319,
-    VAR_VAL_CLEAN_ADDITIONAL = 320,
-    VAR_VAL_PERMISSIVE_MODE = 321,
-    VAR_INCOMING_NUM_TCP = 322,
-    VAR_MSG_BUFFER_SIZE = 323,
-    VAR_KEY_CACHE_SIZE = 324,
-    VAR_KEY_CACHE_SLABS = 325,
-    VAR_TRUSTED_KEYS_FILE = 326,
-    VAR_VAL_NSEC3_KEYSIZE_ITERATIONS = 327,
-    VAR_USE_SYSLOG = 328,
-    VAR_OUTGOING_INTERFACE = 329,
-    VAR_ROOT_HINTS = 330,
-    VAR_DO_NOT_QUERY_LOCALHOST = 331,
-    VAR_CACHE_MAX_TTL = 332,
-    VAR_HARDEN_DNSSEC_STRIPPED = 333,
-    VAR_ACCESS_CONTROL = 334,
-    VAR_LOCAL_ZONE = 335,
-    VAR_LOCAL_DATA = 336,
-    VAR_INTERFACE_AUTOMATIC = 337,
-    VAR_STATISTICS_INTERVAL = 338,
-    VAR_DO_DAEMONIZE = 339,
-    VAR_USE_CAPS_FOR_ID = 340,
-    VAR_STATISTICS_CUMULATIVE = 341,
-    VAR_OUTGOING_PORT_PERMIT = 342,
-    VAR_OUTGOING_PORT_AVOID = 343,
-    VAR_DLV_ANCHOR_FILE = 344,
-    VAR_DLV_ANCHOR = 345,
-    VAR_NEG_CACHE_SIZE = 346,
-    VAR_HARDEN_REFERRAL_PATH = 347,
-    VAR_PRIVATE_ADDRESS = 348,
-    VAR_PRIVATE_DOMAIN = 349,
-    VAR_REMOTE_CONTROL = 350,
-    VAR_CONTROL_ENABLE = 351,
-    VAR_CONTROL_INTERFACE = 352,
-    VAR_CONTROL_PORT = 353,
-    VAR_SERVER_KEY_FILE = 354,
-    VAR_SERVER_CERT_FILE = 355,
-    VAR_CONTROL_KEY_FILE = 356,
-    VAR_CONTROL_CERT_FILE = 357,
-    VAR_CONTROL_USE_CERT = 358,
-    VAR_EXTENDED_STATISTICS = 359,
-    VAR_LOCAL_DATA_PTR = 360,
-    VAR_JOSTLE_TIMEOUT = 361,
-    VAR_STUB_PRIME = 362,
-    VAR_UNWANTED_REPLY_THRESHOLD = 363,
-    VAR_LOG_TIME_ASCII = 364,
-    VAR_DOMAIN_INSECURE = 365,
-    VAR_PYTHON = 366,
-    VAR_PYTHON_SCRIPT = 367,
-    VAR_VAL_SIG_SKEW_MIN = 368,
-    VAR_VAL_SIG_SKEW_MAX = 369,
-    VAR_CACHE_MIN_TTL = 370,
-    VAR_VAL_LOG_LEVEL = 371,
-    VAR_AUTO_TRUST_ANCHOR_FILE = 372,
-    VAR_KEEP_MISSING = 373,
-    VAR_ADD_HOLDDOWN = 374,
-    VAR_DEL_HOLDDOWN = 375,
-    VAR_SO_RCVBUF = 376,
-    VAR_EDNS_BUFFER_SIZE = 377,
-    VAR_PREFETCH = 378,
-    VAR_PREFETCH_KEY = 379,
-    VAR_SO_SNDBUF = 380,
-    VAR_SO_REUSEPORT = 381,
-    VAR_HARDEN_BELOW_NXDOMAIN = 382,
-    VAR_IGNORE_CD_FLAG = 383,
-    VAR_LOG_QUERIES = 384,
-    VAR_LOG_REPLIES = 385,
-    VAR_LOG_LOCAL_ACTIONS = 386,
-    VAR_TCP_UPSTREAM = 387,
-    VAR_SSL_UPSTREAM = 388,
-    VAR_SSL_SERVICE_KEY = 389,
-    VAR_SSL_SERVICE_PEM = 390,
-    VAR_SSL_PORT = 391,
-    VAR_FORWARD_FIRST = 392,
-    VAR_STUB_SSL_UPSTREAM = 393,
-    VAR_FORWARD_SSL_UPSTREAM = 394,
-    VAR_TLS_CERT_BUNDLE = 395,
-    VAR_HTTPS_PORT = 396,
-    VAR_HTTP_ENDPOINT = 397,
-    VAR_HTTP_MAX_STREAMS = 398,
-    VAR_HTTP_QUERY_BUFFER_SIZE = 399,
-    VAR_HTTP_RESPONSE_BUFFER_SIZE = 400,
-    VAR_HTTP_NODELAY = 401,
-    VAR_STUB_FIRST = 402,
-    VAR_MINIMAL_RESPONSES = 403,
-    VAR_RRSET_ROUNDROBIN = 404,
-    VAR_MAX_UDP_SIZE = 405,
-    VAR_DELAY_CLOSE = 406,
-    VAR_UNBLOCK_LAN_ZONES = 407,
-    VAR_INSECURE_LAN_ZONES = 408,
-    VAR_INFRA_CACHE_MIN_RTT = 409,
-    VAR_DNS64_PREFIX = 410,
-    VAR_DNS64_SYNTHALL = 411,
-    VAR_DNS64_IGNORE_AAAA = 412,
-    VAR_DNSTAP = 413,
-    VAR_DNSTAP_ENABLE = 414,
-    VAR_DNSTAP_SOCKET_PATH = 415,
-    VAR_DNSTAP_IP = 416,
-    VAR_DNSTAP_TLS = 417,
-    VAR_DNSTAP_TLS_SERVER_NAME = 418,
-    VAR_DNSTAP_TLS_CERT_BUNDLE = 419,
-    VAR_DNSTAP_TLS_CLIENT_KEY_FILE = 420,
-    VAR_DNSTAP_TLS_CLIENT_CERT_FILE = 421,
-    VAR_DNSTAP_SEND_IDENTITY = 422,
-    VAR_DNSTAP_SEND_VERSION = 423,
-    VAR_DNSTAP_IDENTITY = 424,
-    VAR_DNSTAP_VERSION = 425,
-    VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 426,
-    VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 427,
-    VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 428,
-    VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 429,
-    VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 430,
-    VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 431,
-    VAR_RESPONSE_IP_TAG = 432,
-    VAR_RESPONSE_IP = 433,
-    VAR_RESPONSE_IP_DATA = 434,
-    VAR_HARDEN_ALGO_DOWNGRADE = 435,
-    VAR_IP_TRANSPARENT = 436,
-    VAR_IP_DSCP = 437,
-    VAR_DISABLE_DNSSEC_LAME_CHECK = 438,
-    VAR_IP_RATELIMIT = 439,
-    VAR_IP_RATELIMIT_SLABS = 440,
-    VAR_IP_RATELIMIT_SIZE = 441,
-    VAR_RATELIMIT = 442,
-    VAR_RATELIMIT_SLABS = 443,
-    VAR_RATELIMIT_SIZE = 444,
-    VAR_RATELIMIT_FOR_DOMAIN = 445,
-    VAR_RATELIMIT_BELOW_DOMAIN = 446,
-    VAR_IP_RATELIMIT_FACTOR = 447,
-    VAR_RATELIMIT_FACTOR = 448,
-    VAR_SEND_CLIENT_SUBNET = 449,
-    VAR_CLIENT_SUBNET_ZONE = 450,
-    VAR_CLIENT_SUBNET_ALWAYS_FORWARD = 451,
-    VAR_CLIENT_SUBNET_OPCODE = 452,
-    VAR_MAX_CLIENT_SUBNET_IPV4 = 453,
-    VAR_MAX_CLIENT_SUBNET_IPV6 = 454,
-    VAR_MIN_CLIENT_SUBNET_IPV4 = 455,
-    VAR_MIN_CLIENT_SUBNET_IPV6 = 456,
-    VAR_MAX_ECS_TREE_SIZE_IPV4 = 457,
-    VAR_MAX_ECS_TREE_SIZE_IPV6 = 458,
-    VAR_CAPS_WHITELIST = 459,
-    VAR_CACHE_MAX_NEGATIVE_TTL = 460,
-    VAR_PERMIT_SMALL_HOLDDOWN = 461,
-    VAR_QNAME_MINIMISATION = 462,
-    VAR_QNAME_MINIMISATION_STRICT = 463,
-    VAR_IP_FREEBIND = 464,
-    VAR_DEFINE_TAG = 465,
-    VAR_LOCAL_ZONE_TAG = 466,
-    VAR_ACCESS_CONTROL_TAG = 467,
-    VAR_LOCAL_ZONE_OVERRIDE = 468,
-    VAR_ACCESS_CONTROL_TAG_ACTION = 469,
-    VAR_ACCESS_CONTROL_TAG_DATA = 470,
-    VAR_VIEW = 471,
-    VAR_ACCESS_CONTROL_VIEW = 472,
-    VAR_VIEW_FIRST = 473,
-    VAR_SERVE_EXPIRED = 474,
-    VAR_SERVE_EXPIRED_TTL = 475,
-    VAR_SERVE_EXPIRED_TTL_RESET = 476,
-    VAR_SERVE_EXPIRED_REPLY_TTL = 477,
-    VAR_SERVE_EXPIRED_CLIENT_TIMEOUT = 478,
-    VAR_FAKE_DSA = 479,
-    VAR_FAKE_SHA1 = 480,
-    VAR_LOG_IDENTITY = 481,
-    VAR_HIDE_TRUSTANCHOR = 482,
-    VAR_TRUST_ANCHOR_SIGNALING = 483,
-    VAR_AGGRESSIVE_NSEC = 484,
-    VAR_USE_SYSTEMD = 485,
-    VAR_SHM_ENABLE = 486,
-    VAR_SHM_KEY = 487,
-    VAR_ROOT_KEY_SENTINEL = 488,
-    VAR_DNSCRYPT = 489,
-    VAR_DNSCRYPT_ENABLE = 490,
-    VAR_DNSCRYPT_PORT = 491,
-    VAR_DNSCRYPT_PROVIDER = 492,
-    VAR_DNSCRYPT_SECRET_KEY = 493,
-    VAR_DNSCRYPT_PROVIDER_CERT = 494,
-    VAR_DNSCRYPT_PROVIDER_CERT_ROTATED = 495,
-    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 496,
-    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 497,
-    VAR_DNSCRYPT_NONCE_CACHE_SIZE = 498,
-    VAR_DNSCRYPT_NONCE_CACHE_SLABS = 499,
-    VAR_IPSECMOD_ENABLED = 500,
-    VAR_IPSECMOD_HOOK = 501,
-    VAR_IPSECMOD_IGNORE_BOGUS = 502,
-    VAR_IPSECMOD_MAX_TTL = 503,
-    VAR_IPSECMOD_WHITELIST = 504,
-    VAR_IPSECMOD_STRICT = 505,
-    VAR_CACHEDB = 506,
-    VAR_CACHEDB_BACKEND = 507,
-    VAR_CACHEDB_SECRETSEED = 508,
-    VAR_CACHEDB_REDISHOST = 509,
-    VAR_CACHEDB_REDISPORT = 510,
-    VAR_CACHEDB_REDISTIMEOUT = 511,
-    VAR_CACHEDB_REDISEXPIRERECORDS = 512,
-    VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM = 513,
-    VAR_FOR_UPSTREAM = 514,
-    VAR_AUTH_ZONE = 515,
-    VAR_ZONEFILE = 516,
-    VAR_MASTER = 517,
-    VAR_URL = 518,
-    VAR_FOR_DOWNSTREAM = 519,
-    VAR_FALLBACK_ENABLED = 520,
-    VAR_TLS_ADDITIONAL_PORT = 521,
-    VAR_LOW_RTT = 522,
-    VAR_LOW_RTT_PERMIL = 523,
-    VAR_FAST_SERVER_PERMIL = 524,
-    VAR_FAST_SERVER_NUM = 525,
-    VAR_ALLOW_NOTIFY = 526,
-    VAR_TLS_WIN_CERT = 527,
-    VAR_TCP_CONNECTION_LIMIT = 528,
-    VAR_FORWARD_NO_CACHE = 529,
-    VAR_STUB_NO_CACHE = 530,
-    VAR_LOG_SERVFAIL = 531,
-    VAR_DENY_ANY = 532,
-    VAR_UNKNOWN_SERVER_TIME_LIMIT = 533,
-    VAR_LOG_TAG_QUERYREPLY = 534,
-    VAR_STREAM_WAIT_SIZE = 535,
-    VAR_TLS_CIPHERS = 536,
-    VAR_TLS_CIPHERSUITES = 537,
-    VAR_TLS_USE_SNI = 538,
-    VAR_IPSET = 539,
-    VAR_IPSET_NAME_V4 = 540,
-    VAR_IPSET_NAME_V6 = 541,
-    VAR_TLS_SESSION_TICKET_KEYS = 542,
-    VAR_RPZ = 543,
-    VAR_TAGS = 544,
-    VAR_RPZ_ACTION_OVERRIDE = 545,
-    VAR_RPZ_CNAME_OVERRIDE = 546,
-    VAR_RPZ_LOG = 547,
-    VAR_RPZ_LOG_NAME = 548,
-    VAR_DYNLIB = 549,
-    VAR_DYNLIB_FILE = 550
+    VAR_FORCE_TOPLEVEL = 266,
+    VAR_SERVER = 267,
+    VAR_VERBOSITY = 268,
+    VAR_NUM_THREADS = 269,
+    VAR_PORT = 270,
+    VAR_OUTGOING_RANGE = 271,
+    VAR_INTERFACE = 272,
+    VAR_PREFER_IP4 = 273,
+    VAR_DO_IP4 = 274,
+    VAR_DO_IP6 = 275,
+    VAR_PREFER_IP6 = 276,
+    VAR_DO_UDP = 277,
+    VAR_DO_TCP = 278,
+    VAR_TCP_MSS = 279,
+    VAR_OUTGOING_TCP_MSS = 280,
+    VAR_TCP_IDLE_TIMEOUT = 281,
+    VAR_EDNS_TCP_KEEPALIVE = 282,
+    VAR_EDNS_TCP_KEEPALIVE_TIMEOUT = 283,
+    VAR_CHROOT = 284,
+    VAR_USERNAME = 285,
+    VAR_DIRECTORY = 286,
+    VAR_LOGFILE = 287,
+    VAR_PIDFILE = 288,
+    VAR_MSG_CACHE_SIZE = 289,
+    VAR_MSG_CACHE_SLABS = 290,
+    VAR_NUM_QUERIES_PER_THREAD = 291,
+    VAR_RRSET_CACHE_SIZE = 292,
+    VAR_RRSET_CACHE_SLABS = 293,
+    VAR_OUTGOING_NUM_TCP = 294,
+    VAR_INFRA_HOST_TTL = 295,
+    VAR_INFRA_LAME_TTL = 296,
+    VAR_INFRA_CACHE_SLABS = 297,
+    VAR_INFRA_CACHE_NUMHOSTS = 298,
+    VAR_INFRA_CACHE_LAME_SIZE = 299,
+    VAR_NAME = 300,
+    VAR_STUB_ZONE = 301,
+    VAR_STUB_HOST = 302,
+    VAR_STUB_ADDR = 303,
+    VAR_TARGET_FETCH_POLICY = 304,
+    VAR_HARDEN_SHORT_BUFSIZE = 305,
+    VAR_HARDEN_LARGE_QUERIES = 306,
+    VAR_FORWARD_ZONE = 307,
+    VAR_FORWARD_HOST = 308,
+    VAR_FORWARD_ADDR = 309,
+    VAR_DO_NOT_QUERY_ADDRESS = 310,
+    VAR_HIDE_IDENTITY = 311,
+    VAR_HIDE_VERSION = 312,
+    VAR_IDENTITY = 313,
+    VAR_VERSION = 314,
+    VAR_HARDEN_GLUE = 315,
+    VAR_MODULE_CONF = 316,
+    VAR_TRUST_ANCHOR_FILE = 317,
+    VAR_TRUST_ANCHOR = 318,
+    VAR_VAL_OVERRIDE_DATE = 319,
+    VAR_BOGUS_TTL = 320,
+    VAR_VAL_CLEAN_ADDITIONAL = 321,
+    VAR_VAL_PERMISSIVE_MODE = 322,
+    VAR_INCOMING_NUM_TCP = 323,
+    VAR_MSG_BUFFER_SIZE = 324,
+    VAR_KEY_CACHE_SIZE = 325,
+    VAR_KEY_CACHE_SLABS = 326,
+    VAR_TRUSTED_KEYS_FILE = 327,
+    VAR_VAL_NSEC3_KEYSIZE_ITERATIONS = 328,
+    VAR_USE_SYSLOG = 329,
+    VAR_OUTGOING_INTERFACE = 330,
+    VAR_ROOT_HINTS = 331,
+    VAR_DO_NOT_QUERY_LOCALHOST = 332,
+    VAR_CACHE_MAX_TTL = 333,
+    VAR_HARDEN_DNSSEC_STRIPPED = 334,
+    VAR_ACCESS_CONTROL = 335,
+    VAR_LOCAL_ZONE = 336,
+    VAR_LOCAL_DATA = 337,
+    VAR_INTERFACE_AUTOMATIC = 338,
+    VAR_STATISTICS_INTERVAL = 339,
+    VAR_DO_DAEMONIZE = 340,
+    VAR_USE_CAPS_FOR_ID = 341,
+    VAR_STATISTICS_CUMULATIVE = 342,
+    VAR_OUTGOING_PORT_PERMIT = 343,
+    VAR_OUTGOING_PORT_AVOID = 344,
+    VAR_DLV_ANCHOR_FILE = 345,
+    VAR_DLV_ANCHOR = 346,
+    VAR_NEG_CACHE_SIZE = 347,
+    VAR_HARDEN_REFERRAL_PATH = 348,
+    VAR_PRIVATE_ADDRESS = 349,
+    VAR_PRIVATE_DOMAIN = 350,
+    VAR_REMOTE_CONTROL = 351,
+    VAR_CONTROL_ENABLE = 352,
+    VAR_CONTROL_INTERFACE = 353,
+    VAR_CONTROL_PORT = 354,
+    VAR_SERVER_KEY_FILE = 355,
+    VAR_SERVER_CERT_FILE = 356,
+    VAR_CONTROL_KEY_FILE = 357,
+    VAR_CONTROL_CERT_FILE = 358,
+    VAR_CONTROL_USE_CERT = 359,
+    VAR_EXTENDED_STATISTICS = 360,
+    VAR_LOCAL_DATA_PTR = 361,
+    VAR_JOSTLE_TIMEOUT = 362,
+    VAR_STUB_PRIME = 363,
+    VAR_UNWANTED_REPLY_THRESHOLD = 364,
+    VAR_LOG_TIME_ASCII = 365,
+    VAR_DOMAIN_INSECURE = 366,
+    VAR_PYTHON = 367,
+    VAR_PYTHON_SCRIPT = 368,
+    VAR_VAL_SIG_SKEW_MIN = 369,
+    VAR_VAL_SIG_SKEW_MAX = 370,
+    VAR_CACHE_MIN_TTL = 371,
+    VAR_VAL_LOG_LEVEL = 372,
+    VAR_AUTO_TRUST_ANCHOR_FILE = 373,
+    VAR_KEEP_MISSING = 374,
+    VAR_ADD_HOLDDOWN = 375,
+    VAR_DEL_HOLDDOWN = 376,
+    VAR_SO_RCVBUF = 377,
+    VAR_EDNS_BUFFER_SIZE = 378,
+    VAR_PREFETCH = 379,
+    VAR_PREFETCH_KEY = 380,
+    VAR_SO_SNDBUF = 381,
+    VAR_SO_REUSEPORT = 382,
+    VAR_HARDEN_BELOW_NXDOMAIN = 383,
+    VAR_IGNORE_CD_FLAG = 384,
+    VAR_LOG_QUERIES = 385,
+    VAR_LOG_REPLIES = 386,
+    VAR_LOG_LOCAL_ACTIONS = 387,
+    VAR_TCP_UPSTREAM = 388,
+    VAR_SSL_UPSTREAM = 389,
+    VAR_SSL_SERVICE_KEY = 390,
+    VAR_SSL_SERVICE_PEM = 391,
+    VAR_SSL_PORT = 392,
+    VAR_FORWARD_FIRST = 393,
+    VAR_STUB_SSL_UPSTREAM = 394,
+    VAR_FORWARD_SSL_UPSTREAM = 395,
+    VAR_TLS_CERT_BUNDLE = 396,
+    VAR_HTTPS_PORT = 397,
+    VAR_HTTP_ENDPOINT = 398,
+    VAR_HTTP_MAX_STREAMS = 399,
+    VAR_HTTP_QUERY_BUFFER_SIZE = 400,
+    VAR_HTTP_RESPONSE_BUFFER_SIZE = 401,
+    VAR_HTTP_NODELAY = 402,
+    VAR_STUB_FIRST = 403,
+    VAR_MINIMAL_RESPONSES = 404,
+    VAR_RRSET_ROUNDROBIN = 405,
+    VAR_MAX_UDP_SIZE = 406,
+    VAR_DELAY_CLOSE = 407,
+    VAR_UNBLOCK_LAN_ZONES = 408,
+    VAR_INSECURE_LAN_ZONES = 409,
+    VAR_INFRA_CACHE_MIN_RTT = 410,
+    VAR_DNS64_PREFIX = 411,
+    VAR_DNS64_SYNTHALL = 412,
+    VAR_DNS64_IGNORE_AAAA = 413,
+    VAR_DNSTAP = 414,
+    VAR_DNSTAP_ENABLE = 415,
+    VAR_DNSTAP_SOCKET_PATH = 416,
+    VAR_DNSTAP_IP = 417,
+    VAR_DNSTAP_TLS = 418,
+    VAR_DNSTAP_TLS_SERVER_NAME = 419,
+    VAR_DNSTAP_TLS_CERT_BUNDLE = 420,
+    VAR_DNSTAP_TLS_CLIENT_KEY_FILE = 421,
+    VAR_DNSTAP_TLS_CLIENT_CERT_FILE = 422,
+    VAR_DNSTAP_SEND_IDENTITY = 423,
+    VAR_DNSTAP_SEND_VERSION = 424,
+    VAR_DNSTAP_BIDIRECTIONAL = 425,
+    VAR_DNSTAP_IDENTITY = 426,
+    VAR_DNSTAP_VERSION = 427,
+    VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 428,
+    VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 429,
+    VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 430,
+    VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 431,
+    VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 432,
+    VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 433,
+    VAR_RESPONSE_IP_TAG = 434,
+    VAR_RESPONSE_IP = 435,
+    VAR_RESPONSE_IP_DATA = 436,
+    VAR_HARDEN_ALGO_DOWNGRADE = 437,
+    VAR_IP_TRANSPARENT = 438,
+    VAR_IP_DSCP = 439,
+    VAR_DISABLE_DNSSEC_LAME_CHECK = 440,
+    VAR_IP_RATELIMIT = 441,
+    VAR_IP_RATELIMIT_SLABS = 442,
+    VAR_IP_RATELIMIT_SIZE = 443,
+    VAR_RATELIMIT = 444,
+    VAR_RATELIMIT_SLABS = 445,
+    VAR_RATELIMIT_SIZE = 446,
+    VAR_RATELIMIT_FOR_DOMAIN = 447,
+    VAR_RATELIMIT_BELOW_DOMAIN = 448,
+    VAR_IP_RATELIMIT_FACTOR = 449,
+    VAR_RATELIMIT_FACTOR = 450,
+    VAR_SEND_CLIENT_SUBNET = 451,
+    VAR_CLIENT_SUBNET_ZONE = 452,
+    VAR_CLIENT_SUBNET_ALWAYS_FORWARD = 453,
+    VAR_CLIENT_SUBNET_OPCODE = 454,
+    VAR_MAX_CLIENT_SUBNET_IPV4 = 455,
+    VAR_MAX_CLIENT_SUBNET_IPV6 = 456,
+    VAR_MIN_CLIENT_SUBNET_IPV4 = 457,
+    VAR_MIN_CLIENT_SUBNET_IPV6 = 458,
+    VAR_MAX_ECS_TREE_SIZE_IPV4 = 459,
+    VAR_MAX_ECS_TREE_SIZE_IPV6 = 460,
+    VAR_CAPS_WHITELIST = 461,
+    VAR_CACHE_MAX_NEGATIVE_TTL = 462,
+    VAR_PERMIT_SMALL_HOLDDOWN = 463,
+    VAR_QNAME_MINIMISATION = 464,
+    VAR_QNAME_MINIMISATION_STRICT = 465,
+    VAR_IP_FREEBIND = 466,
+    VAR_DEFINE_TAG = 467,
+    VAR_LOCAL_ZONE_TAG = 468,
+    VAR_ACCESS_CONTROL_TAG = 469,
+    VAR_LOCAL_ZONE_OVERRIDE = 470,
+    VAR_ACCESS_CONTROL_TAG_ACTION = 471,
+    VAR_ACCESS_CONTROL_TAG_DATA = 472,
+    VAR_VIEW = 473,
+    VAR_ACCESS_CONTROL_VIEW = 474,
+    VAR_VIEW_FIRST = 475,
+    VAR_SERVE_EXPIRED = 476,
+    VAR_SERVE_EXPIRED_TTL = 477,
+    VAR_SERVE_EXPIRED_TTL_RESET = 478,
+    VAR_SERVE_EXPIRED_REPLY_TTL = 479,
+    VAR_SERVE_EXPIRED_CLIENT_TIMEOUT = 480,
+    VAR_FAKE_DSA = 481,
+    VAR_FAKE_SHA1 = 482,
+    VAR_LOG_IDENTITY = 483,
+    VAR_HIDE_TRUSTANCHOR = 484,
+    VAR_TRUST_ANCHOR_SIGNALING = 485,
+    VAR_AGGRESSIVE_NSEC = 486,
+    VAR_USE_SYSTEMD = 487,
+    VAR_SHM_ENABLE = 488,
+    VAR_SHM_KEY = 489,
+    VAR_ROOT_KEY_SENTINEL = 490,
+    VAR_DNSCRYPT = 491,
+    VAR_DNSCRYPT_ENABLE = 492,
+    VAR_DNSCRYPT_PORT = 493,
+    VAR_DNSCRYPT_PROVIDER = 494,
+    VAR_DNSCRYPT_SECRET_KEY = 495,
+    VAR_DNSCRYPT_PROVIDER_CERT = 496,
+    VAR_DNSCRYPT_PROVIDER_CERT_ROTATED = 497,
+    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 498,
+    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 499,
+    VAR_DNSCRYPT_NONCE_CACHE_SIZE = 500,
+    VAR_DNSCRYPT_NONCE_CACHE_SLABS = 501,
+    VAR_IPSECMOD_ENABLED = 502,
+    VAR_IPSECMOD_HOOK = 503,
+    VAR_IPSECMOD_IGNORE_BOGUS = 504,
+    VAR_IPSECMOD_MAX_TTL = 505,
+    VAR_IPSECMOD_WHITELIST = 506,
+    VAR_IPSECMOD_STRICT = 507,
+    VAR_CACHEDB = 508,
+    VAR_CACHEDB_BACKEND = 509,
+    VAR_CACHEDB_SECRETSEED = 510,
+    VAR_CACHEDB_REDISHOST = 511,
+    VAR_CACHEDB_REDISPORT = 512,
+    VAR_CACHEDB_REDISTIMEOUT = 513,
+    VAR_CACHEDB_REDISEXPIRERECORDS = 514,
+    VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM = 515,
+    VAR_FOR_UPSTREAM = 516,
+    VAR_AUTH_ZONE = 517,
+    VAR_ZONEFILE = 518,
+    VAR_MASTER = 519,
+    VAR_URL = 520,
+    VAR_FOR_DOWNSTREAM = 521,
+    VAR_FALLBACK_ENABLED = 522,
+    VAR_TLS_ADDITIONAL_PORT = 523,
+    VAR_LOW_RTT = 524,
+    VAR_LOW_RTT_PERMIL = 525,
+    VAR_FAST_SERVER_PERMIL = 526,
+    VAR_FAST_SERVER_NUM = 527,
+    VAR_ALLOW_NOTIFY = 528,
+    VAR_TLS_WIN_CERT = 529,
+    VAR_TCP_CONNECTION_LIMIT = 530,
+    VAR_FORWARD_NO_CACHE = 531,
+    VAR_STUB_NO_CACHE = 532,
+    VAR_LOG_SERVFAIL = 533,
+    VAR_DENY_ANY = 534,
+    VAR_UNKNOWN_SERVER_TIME_LIMIT = 535,
+    VAR_LOG_TAG_QUERYREPLY = 536,
+    VAR_STREAM_WAIT_SIZE = 537,
+    VAR_TLS_CIPHERS = 538,
+    VAR_TLS_CIPHERSUITES = 539,
+    VAR_TLS_USE_SNI = 540,
+    VAR_IPSET = 541,
+    VAR_IPSET_NAME_V4 = 542,
+    VAR_IPSET_NAME_V6 = 543,
+    VAR_TLS_SESSION_TICKET_KEYS = 544,
+    VAR_RPZ = 545,
+    VAR_TAGS = 546,
+    VAR_RPZ_ACTION_OVERRIDE = 547,
+    VAR_RPZ_CNAME_OVERRIDE = 548,
+    VAR_RPZ_LOG = 549,
+    VAR_RPZ_LOG_NAME = 550,
+    VAR_DYNLIB = 551,
+    VAR_DYNLIB_FILE = 552,
+    VAR_EDNS_CLIENT_TAG = 553
   };
 #endif
 /* Tokens.  */
@@ -353,291 +356,294 @@ extern int yydebug;
 #define ANY 263
 #define ZONESTR 264
 #define STRING_ARG 265
-#define VAR_SERVER 266
-#define VAR_VERBOSITY 267
-#define VAR_NUM_THREADS 268
-#define VAR_PORT 269
-#define VAR_OUTGOING_RANGE 270
-#define VAR_INTERFACE 271
-#define VAR_PREFER_IP4 272
-#define VAR_DO_IP4 273
-#define VAR_DO_IP6 274
-#define VAR_PREFER_IP6 275
-#define VAR_DO_UDP 276
-#define VAR_DO_TCP 277
-#define VAR_TCP_MSS 278
-#define VAR_OUTGOING_TCP_MSS 279
-#define VAR_TCP_IDLE_TIMEOUT 280
-#define VAR_EDNS_TCP_KEEPALIVE 281
-#define VAR_EDNS_TCP_KEEPALIVE_TIMEOUT 282
-#define VAR_CHROOT 283
-#define VAR_USERNAME 284
-#define VAR_DIRECTORY 285
-#define VAR_LOGFILE 286
-#define VAR_PIDFILE 287
-#define VAR_MSG_CACHE_SIZE 288
-#define VAR_MSG_CACHE_SLABS 289
-#define VAR_NUM_QUERIES_PER_THREAD 290
-#define VAR_RRSET_CACHE_SIZE 291
-#define VAR_RRSET_CACHE_SLABS 292
-#define VAR_OUTGOING_NUM_TCP 293
-#define VAR_INFRA_HOST_TTL 294
-#define VAR_INFRA_LAME_TTL 295
-#define VAR_INFRA_CACHE_SLABS 296
-#define VAR_INFRA_CACHE_NUMHOSTS 297
-#define VAR_INFRA_CACHE_LAME_SIZE 298
-#define VAR_NAME 299
-#define VAR_STUB_ZONE 300
-#define VAR_STUB_HOST 301
-#define VAR_STUB_ADDR 302
-#define VAR_TARGET_FETCH_POLICY 303
-#define VAR_HARDEN_SHORT_BUFSIZE 304
-#define VAR_HARDEN_LARGE_QUERIES 305
-#define VAR_FORWARD_ZONE 306
-#define VAR_FORWARD_HOST 307
-#define VAR_FORWARD_ADDR 308
-#define VAR_DO_NOT_QUERY_ADDRESS 309
-#define VAR_HIDE_IDENTITY 310
-#define VAR_HIDE_VERSION 311
-#define VAR_IDENTITY 312
-#define VAR_VERSION 313
-#define VAR_HARDEN_GLUE 314
-#define VAR_MODULE_CONF 315
-#define VAR_TRUST_ANCHOR_FILE 316
-#define VAR_TRUST_ANCHOR 317
-#define VAR_VAL_OVERRIDE_DATE 318
-#define VAR_BOGUS_TTL 319
-#define VAR_VAL_CLEAN_ADDITIONAL 320
-#define VAR_VAL_PERMISSIVE_MODE 321
-#define VAR_INCOMING_NUM_TCP 322
-#define VAR_MSG_BUFFER_SIZE 323
-#define VAR_KEY_CACHE_SIZE 324
-#define VAR_KEY_CACHE_SLABS 325
-#define VAR_TRUSTED_KEYS_FILE 326
-#define VAR_VAL_NSEC3_KEYSIZE_ITERATIONS 327
-#define VAR_USE_SYSLOG 328
-#define VAR_OUTGOING_INTERFACE 329
-#define VAR_ROOT_HINTS 330
-#define VAR_DO_NOT_QUERY_LOCALHOST 331
-#define VAR_CACHE_MAX_TTL 332
-#define VAR_HARDEN_DNSSEC_STRIPPED 333
-#define VAR_ACCESS_CONTROL 334
-#define VAR_LOCAL_ZONE 335
-#define VAR_LOCAL_DATA 336
-#define VAR_INTERFACE_AUTOMATIC 337
-#define VAR_STATISTICS_INTERVAL 338
-#define VAR_DO_DAEMONIZE 339
-#define VAR_USE_CAPS_FOR_ID 340
-#define VAR_STATISTICS_CUMULATIVE 341
-#define VAR_OUTGOING_PORT_PERMIT 342
-#define VAR_OUTGOING_PORT_AVOID 343
-#define VAR_DLV_ANCHOR_FILE 344
-#define VAR_DLV_ANCHOR 345
-#define VAR_NEG_CACHE_SIZE 346
-#define VAR_HARDEN_REFERRAL_PATH 347
-#define VAR_PRIVATE_ADDRESS 348
-#define VAR_PRIVATE_DOMAIN 349
-#define VAR_REMOTE_CONTROL 350
-#define VAR_CONTROL_ENABLE 351
-#define VAR_CONTROL_INTERFACE 352
-#define VAR_CONTROL_PORT 353
-#define VAR_SERVER_KEY_FILE 354
-#define VAR_SERVER_CERT_FILE 355
-#define VAR_CONTROL_KEY_FILE 356
-#define VAR_CONTROL_CERT_FILE 357
-#define VAR_CONTROL_USE_CERT 358
-#define VAR_EXTENDED_STATISTICS 359
-#define VAR_LOCAL_DATA_PTR 360
-#define VAR_JOSTLE_TIMEOUT 361
-#define VAR_STUB_PRIME 362
-#define VAR_UNWANTED_REPLY_THRESHOLD 363
-#define VAR_LOG_TIME_ASCII 364
-#define VAR_DOMAIN_INSECURE 365
-#define VAR_PYTHON 366
-#define VAR_PYTHON_SCRIPT 367
-#define VAR_VAL_SIG_SKEW_MIN 368
-#define VAR_VAL_SIG_SKEW_MAX 369
-#define VAR_CACHE_MIN_TTL 370
-#define VAR_VAL_LOG_LEVEL 371
-#define VAR_AUTO_TRUST_ANCHOR_FILE 372
-#define VAR_KEEP_MISSING 373
-#define VAR_ADD_HOLDDOWN 374
-#define VAR_DEL_HOLDDOWN 375
-#define VAR_SO_RCVBUF 376
-#define VAR_EDNS_BUFFER_SIZE 377
-#define VAR_PREFETCH 378
-#define VAR_PREFETCH_KEY 379
-#define VAR_SO_SNDBUF 380
-#define VAR_SO_REUSEPORT 381
-#define VAR_HARDEN_BELOW_NXDOMAIN 382
-#define VAR_IGNORE_CD_FLAG 383
-#define VAR_LOG_QUERIES 384
-#define VAR_LOG_REPLIES 385
-#define VAR_LOG_LOCAL_ACTIONS 386
-#define VAR_TCP_UPSTREAM 387
-#define VAR_SSL_UPSTREAM 388
-#define VAR_SSL_SERVICE_KEY 389
-#define VAR_SSL_SERVICE_PEM 390
-#define VAR_SSL_PORT 391
-#define VAR_FORWARD_FIRST 392
-#define VAR_STUB_SSL_UPSTREAM 393
-#define VAR_FORWARD_SSL_UPSTREAM 394
-#define VAR_TLS_CERT_BUNDLE 395
-#define VAR_HTTPS_PORT 396
-#define VAR_HTTP_ENDPOINT 397
-#define VAR_HTTP_MAX_STREAMS 398
-#define VAR_HTTP_QUERY_BUFFER_SIZE 399
-#define VAR_HTTP_RESPONSE_BUFFER_SIZE 400
-#define VAR_HTTP_NODELAY 401
-#define VAR_STUB_FIRST 402
-#define VAR_MINIMAL_RESPONSES 403
-#define VAR_RRSET_ROUNDROBIN 404
-#define VAR_MAX_UDP_SIZE 405
-#define VAR_DELAY_CLOSE 406
-#define VAR_UNBLOCK_LAN_ZONES 407
-#define VAR_INSECURE_LAN_ZONES 408
-#define VAR_INFRA_CACHE_MIN_RTT 409
-#define VAR_DNS64_PREFIX 410
-#define VAR_DNS64_SYNTHALL 411
-#define VAR_DNS64_IGNORE_AAAA 412
-#define VAR_DNSTAP 413
-#define VAR_DNSTAP_ENABLE 414
-#define VAR_DNSTAP_SOCKET_PATH 415
-#define VAR_DNSTAP_IP 416
-#define VAR_DNSTAP_TLS 417
-#define VAR_DNSTAP_TLS_SERVER_NAME 418
-#define VAR_DNSTAP_TLS_CERT_BUNDLE 419
-#define VAR_DNSTAP_TLS_CLIENT_KEY_FILE 420
-#define VAR_DNSTAP_TLS_CLIENT_CERT_FILE 421
-#define VAR_DNSTAP_SEND_IDENTITY 422
-#define VAR_DNSTAP_SEND_VERSION 423
-#define VAR_DNSTAP_IDENTITY 424
-#define VAR_DNSTAP_VERSION 425
-#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 426
-#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 427
-#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 428
-#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 429
-#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 430
-#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 431
-#define VAR_RESPONSE_IP_TAG 432
-#define VAR_RESPONSE_IP 433
-#define VAR_RESPONSE_IP_DATA 434
-#define VAR_HARDEN_ALGO_DOWNGRADE 435
-#define VAR_IP_TRANSPARENT 436
-#define VAR_IP_DSCP 437
-#define VAR_DISABLE_DNSSEC_LAME_CHECK 438
-#define VAR_IP_RATELIMIT 439
-#define VAR_IP_RATELIMIT_SLABS 440
-#define VAR_IP_RATELIMIT_SIZE 441
-#define VAR_RATELIMIT 442
-#define VAR_RATELIMIT_SLABS 443
-#define VAR_RATELIMIT_SIZE 444
-#define VAR_RATELIMIT_FOR_DOMAIN 445
-#define VAR_RATELIMIT_BELOW_DOMAIN 446
-#define VAR_IP_RATELIMIT_FACTOR 447
-#define VAR_RATELIMIT_FACTOR 448
-#define VAR_SEND_CLIENT_SUBNET 449
-#define VAR_CLIENT_SUBNET_ZONE 450
-#define VAR_CLIENT_SUBNET_ALWAYS_FORWARD 451
-#define VAR_CLIENT_SUBNET_OPCODE 452
-#define VAR_MAX_CLIENT_SUBNET_IPV4 453
-#define VAR_MAX_CLIENT_SUBNET_IPV6 454
-#define VAR_MIN_CLIENT_SUBNET_IPV4 455
-#define VAR_MIN_CLIENT_SUBNET_IPV6 456
-#define VAR_MAX_ECS_TREE_SIZE_IPV4 457
-#define VAR_MAX_ECS_TREE_SIZE_IPV6 458
-#define VAR_CAPS_WHITELIST 459
-#define VAR_CACHE_MAX_NEGATIVE_TTL 460
-#define VAR_PERMIT_SMALL_HOLDDOWN 461
-#define VAR_QNAME_MINIMISATION 462
-#define VAR_QNAME_MINIMISATION_STRICT 463
-#define VAR_IP_FREEBIND 464
-#define VAR_DEFINE_TAG 465
-#define VAR_LOCAL_ZONE_TAG 466
-#define VAR_ACCESS_CONTROL_TAG 467
-#define VAR_LOCAL_ZONE_OVERRIDE 468
-#define VAR_ACCESS_CONTROL_TAG_ACTION 469
-#define VAR_ACCESS_CONTROL_TAG_DATA 470
-#define VAR_VIEW 471
-#define VAR_ACCESS_CONTROL_VIEW 472
-#define VAR_VIEW_FIRST 473
-#define VAR_SERVE_EXPIRED 474
-#define VAR_SERVE_EXPIRED_TTL 475
-#define VAR_SERVE_EXPIRED_TTL_RESET 476
-#define VAR_SERVE_EXPIRED_REPLY_TTL 477
-#define VAR_SERVE_EXPIRED_CLIENT_TIMEOUT 478
-#define VAR_FAKE_DSA 479
-#define VAR_FAKE_SHA1 480
-#define VAR_LOG_IDENTITY 481
-#define VAR_HIDE_TRUSTANCHOR 482
-#define VAR_TRUST_ANCHOR_SIGNALING 483
-#define VAR_AGGRESSIVE_NSEC 484
-#define VAR_USE_SYSTEMD 485
-#define VAR_SHM_ENABLE 486
-#define VAR_SHM_KEY 487
-#define VAR_ROOT_KEY_SENTINEL 488
-#define VAR_DNSCRYPT 489
-#define VAR_DNSCRYPT_ENABLE 490
-#define VAR_DNSCRYPT_PORT 491
-#define VAR_DNSCRYPT_PROVIDER 492
-#define VAR_DNSCRYPT_SECRET_KEY 493
-#define VAR_DNSCRYPT_PROVIDER_CERT 494
-#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 495
-#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 496
-#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 497
-#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 498
-#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 499
-#define VAR_IPSECMOD_ENABLED 500
-#define VAR_IPSECMOD_HOOK 501
-#define VAR_IPSECMOD_IGNORE_BOGUS 502
-#define VAR_IPSECMOD_MAX_TTL 503
-#define VAR_IPSECMOD_WHITELIST 504
-#define VAR_IPSECMOD_STRICT 505
-#define VAR_CACHEDB 506
-#define VAR_CACHEDB_BACKEND 507
-#define VAR_CACHEDB_SECRETSEED 508
-#define VAR_CACHEDB_REDISHOST 509
-#define VAR_CACHEDB_REDISPORT 510
-#define VAR_CACHEDB_REDISTIMEOUT 511
-#define VAR_CACHEDB_REDISEXPIRERECORDS 512
-#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 513
-#define VAR_FOR_UPSTREAM 514
-#define VAR_AUTH_ZONE 515
-#define VAR_ZONEFILE 516
-#define VAR_MASTER 517
-#define VAR_URL 518
-#define VAR_FOR_DOWNSTREAM 519
-#define VAR_FALLBACK_ENABLED 520
-#define VAR_TLS_ADDITIONAL_PORT 521
-#define VAR_LOW_RTT 522
-#define VAR_LOW_RTT_PERMIL 523
-#define VAR_FAST_SERVER_PERMIL 524
-#define VAR_FAST_SERVER_NUM 525
-#define VAR_ALLOW_NOTIFY 526
-#define VAR_TLS_WIN_CERT 527
-#define VAR_TCP_CONNECTION_LIMIT 528
-#define VAR_FORWARD_NO_CACHE 529
-#define VAR_STUB_NO_CACHE 530
-#define VAR_LOG_SERVFAIL 531
-#define VAR_DENY_ANY 532
-#define VAR_UNKNOWN_SERVER_TIME_LIMIT 533
-#define VAR_LOG_TAG_QUERYREPLY 534
-#define VAR_STREAM_WAIT_SIZE 535
-#define VAR_TLS_CIPHERS 536
-#define VAR_TLS_CIPHERSUITES 537
-#define VAR_TLS_USE_SNI 538
-#define VAR_IPSET 539
-#define VAR_IPSET_NAME_V4 540
-#define VAR_IPSET_NAME_V6 541
-#define VAR_TLS_SESSION_TICKET_KEYS 542
-#define VAR_RPZ 543
-#define VAR_TAGS 544
-#define VAR_RPZ_ACTION_OVERRIDE 545
-#define VAR_RPZ_CNAME_OVERRIDE 546
-#define VAR_RPZ_LOG 547
-#define VAR_RPZ_LOG_NAME 548
-#define VAR_DYNLIB 549
-#define VAR_DYNLIB_FILE 550
+#define VAR_FORCE_TOPLEVEL 266
+#define VAR_SERVER 267
+#define VAR_VERBOSITY 268
+#define VAR_NUM_THREADS 269
+#define VAR_PORT 270
+#define VAR_OUTGOING_RANGE 271
+#define VAR_INTERFACE 272
+#define VAR_PREFER_IP4 273
+#define VAR_DO_IP4 274
+#define VAR_DO_IP6 275
+#define VAR_PREFER_IP6 276
+#define VAR_DO_UDP 277
+#define VAR_DO_TCP 278
+#define VAR_TCP_MSS 279
+#define VAR_OUTGOING_TCP_MSS 280
+#define VAR_TCP_IDLE_TIMEOUT 281
+#define VAR_EDNS_TCP_KEEPALIVE 282
+#define VAR_EDNS_TCP_KEEPALIVE_TIMEOUT 283
+#define VAR_CHROOT 284
+#define VAR_USERNAME 285
+#define VAR_DIRECTORY 286
+#define VAR_LOGFILE 287
+#define VAR_PIDFILE 288
+#define VAR_MSG_CACHE_SIZE 289
+#define VAR_MSG_CACHE_SLABS 290
+#define VAR_NUM_QUERIES_PER_THREAD 291
+#define VAR_RRSET_CACHE_SIZE 292
+#define VAR_RRSET_CACHE_SLABS 293
+#define VAR_OUTGOING_NUM_TCP 294
+#define VAR_INFRA_HOST_TTL 295
+#define VAR_INFRA_LAME_TTL 296
+#define VAR_INFRA_CACHE_SLABS 297
+#define VAR_INFRA_CACHE_NUMHOSTS 298
+#define VAR_INFRA_CACHE_LAME_SIZE 299
+#define VAR_NAME 300
+#define VAR_STUB_ZONE 301
+#define VAR_STUB_HOST 302
+#define VAR_STUB_ADDR 303
+#define VAR_TARGET_FETCH_POLICY 304
+#define VAR_HARDEN_SHORT_BUFSIZE 305
+#define VAR_HARDEN_LARGE_QUERIES 306
+#define VAR_FORWARD_ZONE 307
+#define VAR_FORWARD_HOST 308
+#define VAR_FORWARD_ADDR 309
+#define VAR_DO_NOT_QUERY_ADDRESS 310
+#define VAR_HIDE_IDENTITY 311
+#define VAR_HIDE_VERSION 312
+#define VAR_IDENTITY 313
+#define VAR_VERSION 314
+#define VAR_HARDEN_GLUE 315
+#define VAR_MODULE_CONF 316
+#define VAR_TRUST_ANCHOR_FILE 317
+#define VAR_TRUST_ANCHOR 318
+#define VAR_VAL_OVERRIDE_DATE 319
+#define VAR_BOGUS_TTL 320
+#define VAR_VAL_CLEAN_ADDITIONAL 321
+#define VAR_VAL_PERMISSIVE_MODE 322
+#define VAR_INCOMING_NUM_TCP 323
+#define VAR_MSG_BUFFER_SIZE 324
+#define VAR_KEY_CACHE_SIZE 325
+#define VAR_KEY_CACHE_SLABS 326
+#define VAR_TRUSTED_KEYS_FILE 327
+#define VAR_VAL_NSEC3_KEYSIZE_ITERATIONS 328
+#define VAR_USE_SYSLOG 329
+#define VAR_OUTGOING_INTERFACE 330
+#define VAR_ROOT_HINTS 331
+#define VAR_DO_NOT_QUERY_LOCALHOST 332
+#define VAR_CACHE_MAX_TTL 333
+#define VAR_HARDEN_DNSSEC_STRIPPED 334
+#define VAR_ACCESS_CONTROL 335
+#define VAR_LOCAL_ZONE 336
+#define VAR_LOCAL_DATA 337
+#define VAR_INTERFACE_AUTOMATIC 338
+#define VAR_STATISTICS_INTERVAL 339
+#define VAR_DO_DAEMONIZE 340
+#define VAR_USE_CAPS_FOR_ID 341
+#define VAR_STATISTICS_CUMULATIVE 342
+#define VAR_OUTGOING_PORT_PERMIT 343
+#define VAR_OUTGOING_PORT_AVOID 344
+#define VAR_DLV_ANCHOR_FILE 345
+#define VAR_DLV_ANCHOR 346
+#define VAR_NEG_CACHE_SIZE 347
+#define VAR_HARDEN_REFERRAL_PATH 348
+#define VAR_PRIVATE_ADDRESS 349
+#define VAR_PRIVATE_DOMAIN 350
+#define VAR_REMOTE_CONTROL 351
+#define VAR_CONTROL_ENABLE 352
+#define VAR_CONTROL_INTERFACE 353
+#define VAR_CONTROL_PORT 354
+#define VAR_SERVER_KEY_FILE 355
+#define VAR_SERVER_CERT_FILE 356
+#define VAR_CONTROL_KEY_FILE 357
+#define VAR_CONTROL_CERT_FILE 358
+#define VAR_CONTROL_USE_CERT 359
+#define VAR_EXTENDED_STATISTICS 360
+#define VAR_LOCAL_DATA_PTR 361
+#define VAR_JOSTLE_TIMEOUT 362
+#define VAR_STUB_PRIME 363
+#define VAR_UNWANTED_REPLY_THRESHOLD 364
+#define VAR_LOG_TIME_ASCII 365
+#define VAR_DOMAIN_INSECURE 366
+#define VAR_PYTHON 367
+#define VAR_PYTHON_SCRIPT 368
+#define VAR_VAL_SIG_SKEW_MIN 369
+#define VAR_VAL_SIG_SKEW_MAX 370
+#define VAR_CACHE_MIN_TTL 371
+#define VAR_VAL_LOG_LEVEL 372
+#define VAR_AUTO_TRUST_ANCHOR_FILE 373
+#define VAR_KEEP_MISSING 374
+#define VAR_ADD_HOLDDOWN 375
+#define VAR_DEL_HOLDDOWN 376
+#define VAR_SO_RCVBUF 377
+#define VAR_EDNS_BUFFER_SIZE 378
+#define VAR_PREFETCH 379
+#define VAR_PREFETCH_KEY 380
+#define VAR_SO_SNDBUF 381
+#define VAR_SO_REUSEPORT 382
+#define VAR_HARDEN_BELOW_NXDOMAIN 383
+#define VAR_IGNORE_CD_FLAG 384
+#define VAR_LOG_QUERIES 385
+#define VAR_LOG_REPLIES 386
+#define VAR_LOG_LOCAL_ACTIONS 387
+#define VAR_TCP_UPSTREAM 388
+#define VAR_SSL_UPSTREAM 389
+#define VAR_SSL_SERVICE_KEY 390
+#define VAR_SSL_SERVICE_PEM 391
+#define VAR_SSL_PORT 392
+#define VAR_FORWARD_FIRST 393
+#define VAR_STUB_SSL_UPSTREAM 394
+#define VAR_FORWARD_SSL_UPSTREAM 395
+#define VAR_TLS_CERT_BUNDLE 396
+#define VAR_HTTPS_PORT 397
+#define VAR_HTTP_ENDPOINT 398
+#define VAR_HTTP_MAX_STREAMS 399
+#define VAR_HTTP_QUERY_BUFFER_SIZE 400
+#define VAR_HTTP_RESPONSE_BUFFER_SIZE 401
+#define VAR_HTTP_NODELAY 402
+#define VAR_STUB_FIRST 403
+#define VAR_MINIMAL_RESPONSES 404
+#define VAR_RRSET_ROUNDROBIN 405
+#define VAR_MAX_UDP_SIZE 406
+#define VAR_DELAY_CLOSE 407
+#define VAR_UNBLOCK_LAN_ZONES 408
+#define VAR_INSECURE_LAN_ZONES 409
+#define VAR_INFRA_CACHE_MIN_RTT 410
+#define VAR_DNS64_PREFIX 411
+#define VAR_DNS64_SYNTHALL 412
+#define VAR_DNS64_IGNORE_AAAA 413
+#define VAR_DNSTAP 414
+#define VAR_DNSTAP_ENABLE 415
+#define VAR_DNSTAP_SOCKET_PATH 416
+#define VAR_DNSTAP_IP 417
+#define VAR_DNSTAP_TLS 418
+#define VAR_DNSTAP_TLS_SERVER_NAME 419
+#define VAR_DNSTAP_TLS_CERT_BUNDLE 420
+#define VAR_DNSTAP_TLS_CLIENT_KEY_FILE 421
+#define VAR_DNSTAP_TLS_CLIENT_CERT_FILE 422
+#define VAR_DNSTAP_SEND_IDENTITY 423
+#define VAR_DNSTAP_SEND_VERSION 424
+#define VAR_DNSTAP_BIDIRECTIONAL 425
+#define VAR_DNSTAP_IDENTITY 426
+#define VAR_DNSTAP_VERSION 427
+#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 428
+#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 429
+#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 430
+#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 431
+#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 432
+#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 433
+#define VAR_RESPONSE_IP_TAG 434
+#define VAR_RESPONSE_IP 435
+#define VAR_RESPONSE_IP_DATA 436
+#define VAR_HARDEN_ALGO_DOWNGRADE 437
+#define VAR_IP_TRANSPARENT 438
+#define VAR_IP_DSCP 439
+#define VAR_DISABLE_DNSSEC_LAME_CHECK 440
+#define VAR_IP_RATELIMIT 441
+#define VAR_IP_RATELIMIT_SLABS 442
+#define VAR_IP_RATELIMIT_SIZE 443
+#define VAR_RATELIMIT 444
+#define VAR_RATELIMIT_SLABS 445
+#define VAR_RATELIMIT_SIZE 446
+#define VAR_RATELIMIT_FOR_DOMAIN 447
+#define VAR_RATELIMIT_BELOW_DOMAIN 448
+#define VAR_IP_RATELIMIT_FACTOR 449
+#define VAR_RATELIMIT_FACTOR 450
+#define VAR_SEND_CLIENT_SUBNET 451
+#define VAR_CLIENT_SUBNET_ZONE 452
+#define VAR_CLIENT_SUBNET_ALWAYS_FORWARD 453
+#define VAR_CLIENT_SUBNET_OPCODE 454
+#define VAR_MAX_CLIENT_SUBNET_IPV4 455
+#define VAR_MAX_CLIENT_SUBNET_IPV6 456
+#define VAR_MIN_CLIENT_SUBNET_IPV4 457
+#define VAR_MIN_CLIENT_SUBNET_IPV6 458
+#define VAR_MAX_ECS_TREE_SIZE_IPV4 459
+#define VAR_MAX_ECS_TREE_SIZE_IPV6 460
+#define VAR_CAPS_WHITELIST 461
+#define VAR_CACHE_MAX_NEGATIVE_TTL 462
+#define VAR_PERMIT_SMALL_HOLDDOWN 463
+#define VAR_QNAME_MINIMISATION 464
+#define VAR_QNAME_MINIMISATION_STRICT 465
+#define VAR_IP_FREEBIND 466
+#define VAR_DEFINE_TAG 467
+#define VAR_LOCAL_ZONE_TAG 468
+#define VAR_ACCESS_CONTROL_TAG 469
+#define VAR_LOCAL_ZONE_OVERRIDE 470
+#define VAR_ACCESS_CONTROL_TAG_ACTION 471
+#define VAR_ACCESS_CONTROL_TAG_DATA 472
+#define VAR_VIEW 473
+#define VAR_ACCESS_CONTROL_VIEW 474
+#define VAR_VIEW_FIRST 475
+#define VAR_SERVE_EXPIRED 476
+#define VAR_SERVE_EXPIRED_TTL 477
+#define VAR_SERVE_EXPIRED_TTL_RESET 478
+#define VAR_SERVE_EXPIRED_REPLY_TTL 479
+#define VAR_SERVE_EXPIRED_CLIENT_TIMEOUT 480
+#define VAR_FAKE_DSA 481
+#define VAR_FAKE_SHA1 482
+#define VAR_LOG_IDENTITY 483
+#define VAR_HIDE_TRUSTANCHOR 484
+#define VAR_TRUST_ANCHOR_SIGNALING 485
+#define VAR_AGGRESSIVE_NSEC 486
+#define VAR_USE_SYSTEMD 487
+#define VAR_SHM_ENABLE 488
+#define VAR_SHM_KEY 489
+#define VAR_ROOT_KEY_SENTINEL 490
+#define VAR_DNSCRYPT 491
+#define VAR_DNSCRYPT_ENABLE 492
+#define VAR_DNSCRYPT_PORT 493
+#define VAR_DNSCRYPT_PROVIDER 494
+#define VAR_DNSCRYPT_SECRET_KEY 495
+#define VAR_DNSCRYPT_PROVIDER_CERT 496
+#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 497
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 498
+#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 499
+#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 500
+#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 501
+#define VAR_IPSECMOD_ENABLED 502
+#define VAR_IPSECMOD_HOOK 503
+#define VAR_IPSECMOD_IGNORE_BOGUS 504
+#define VAR_IPSECMOD_MAX_TTL 505
+#define VAR_IPSECMOD_WHITELIST 506
+#define VAR_IPSECMOD_STRICT 507
+#define VAR_CACHEDB 508
+#define VAR_CACHEDB_BACKEND 509
+#define VAR_CACHEDB_SECRETSEED 510
+#define VAR_CACHEDB_REDISHOST 511
+#define VAR_CACHEDB_REDISPORT 512
+#define VAR_CACHEDB_REDISTIMEOUT 513
+#define VAR_CACHEDB_REDISEXPIRERECORDS 514
+#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 515
+#define VAR_FOR_UPSTREAM 516
+#define VAR_AUTH_ZONE 517
+#define VAR_ZONEFILE 518
+#define VAR_MASTER 519
+#define VAR_URL 520
+#define VAR_FOR_DOWNSTREAM 521
+#define VAR_FALLBACK_ENABLED 522
+#define VAR_TLS_ADDITIONAL_PORT 523
+#define VAR_LOW_RTT 524
+#define VAR_LOW_RTT_PERMIL 525
+#define VAR_FAST_SERVER_PERMIL 526
+#define VAR_FAST_SERVER_NUM 527
+#define VAR_ALLOW_NOTIFY 528
+#define VAR_TLS_WIN_CERT 529
+#define VAR_TCP_CONNECTION_LIMIT 530
+#define VAR_FORWARD_NO_CACHE 531
+#define VAR_STUB_NO_CACHE 532
+#define VAR_LOG_SERVFAIL 533
+#define VAR_DENY_ANY 534
+#define VAR_UNKNOWN_SERVER_TIME_LIMIT 535
+#define VAR_LOG_TAG_QUERYREPLY 536
+#define VAR_STREAM_WAIT_SIZE 537
+#define VAR_TLS_CIPHERS 538
+#define VAR_TLS_CIPHERSUITES 539
+#define VAR_TLS_USE_SNI 540
+#define VAR_IPSET 541
+#define VAR_IPSET_NAME_V4 542
+#define VAR_IPSET_NAME_V6 543
+#define VAR_TLS_SESSION_TICKET_KEYS 544
+#define VAR_RPZ 545
+#define VAR_TAGS 546
+#define VAR_RPZ_ACTION_OVERRIDE 547
+#define VAR_RPZ_CNAME_OVERRIDE 548
+#define VAR_RPZ_LOG 549
+#define VAR_RPZ_LOG_NAME 550
+#define VAR_DYNLIB 551
+#define VAR_DYNLIB_FILE 552
+#define VAR_EDNS_CLIENT_TAG 553
 
 /* Value type.  */
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
@@ -647,7 +653,7 @@ union YYSTYPE
 
 	char*	str;
 
-#line 651 "util/configparser.h"
+#line 657 "util/configparser.h"
 
 };
 typedef union YYSTYPE YYSTYPE;
diff --git a/util/configparser.y b/util/configparser.y
index ffc8813ff..4419bbc7b 100644
--- a/util/configparser.y
+++ b/util/configparser.y
@@ -69,6 +69,7 @@ extern struct config_parser_state* cfg_parser;
 
 %token SPACE LETTER NEWLINE COMMENT COLON ANY ZONESTR
 %token <str> STRING_ARG
+%token VAR_FORCE_TOPLEVEL
 %token VAR_SERVER VAR_VERBOSITY VAR_NUM_THREADS VAR_PORT
 %token VAR_OUTGOING_RANGE VAR_INTERFACE VAR_PREFER_IP4
 %token VAR_DO_IP4 VAR_DO_IP6 VAR_PREFER_IP6 VAR_DO_UDP VAR_DO_TCP
@@ -122,7 +123,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_DNSTAP VAR_DNSTAP_ENABLE VAR_DNSTAP_SOCKET_PATH VAR_DNSTAP_IP
 %token VAR_DNSTAP_TLS VAR_DNSTAP_TLS_SERVER_NAME VAR_DNSTAP_TLS_CERT_BUNDLE
 %token VAR_DNSTAP_TLS_CLIENT_KEY_FILE VAR_DNSTAP_TLS_CLIENT_CERT_FILE
-%token VAR_DNSTAP_SEND_IDENTITY VAR_DNSTAP_SEND_VERSION
+%token VAR_DNSTAP_SEND_IDENTITY VAR_DNSTAP_SEND_VERSION VAR_DNSTAP_BIDIRECTIONAL
 %token VAR_DNSTAP_IDENTITY VAR_DNSTAP_VERSION
 %token VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES
 %token VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES
@@ -177,7 +178,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_IPSET VAR_IPSET_NAME_V4 VAR_IPSET_NAME_V6
 %token VAR_TLS_SESSION_TICKET_KEYS VAR_RPZ VAR_TAGS VAR_RPZ_ACTION_OVERRIDE
 %token VAR_RPZ_CNAME_OVERRIDE VAR_RPZ_LOG VAR_RPZ_LOG_NAME
-%token VAR_DYNLIB VAR_DYNLIB_FILE
+%token VAR_DYNLIB VAR_DYNLIB_FILE VAR_EDNS_CLIENT_TAG
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -186,16 +187,21 @@ toplevelvar: serverstart contents_server | stubstart contents_stub |
 	rcstart contents_rc | dtstart contents_dt | viewstart contents_view |
 	dnscstart contents_dnsc | cachedbstart contents_cachedb |
 	ipsetstart contents_ipset | authstart contents_auth |
-	rpzstart contents_rpz | dynlibstart contents_dl
+	rpzstart contents_rpz | dynlibstart contents_dl |
+	force_toplevel
+	;
+force_toplevel: VAR_FORCE_TOPLEVEL
+	{
+		OUTYY(("\nP(force-toplevel)\n"));
+	}
 	;
-
 /* server: declaration */
 serverstart: VAR_SERVER
 	{ 
-		OUTYY(("\nP(server:)\n")); 
+		OUTYY(("\nP(server:)\n"));
 	}
 	;
-contents_server: contents_server content_server 
+contents_server: contents_server content_server
 	| ;
 content_server: server_num_threads | server_verbosity | server_port |
 	server_outgoing_range | server_do_ip4 |
@@ -285,7 +291,7 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_unknown_server_time_limit | server_log_tag_queryreply |
 	server_stream_wait_size | server_tls_ciphers |
 	server_tls_ciphersuites | server_tls_session_ticket_keys |
-	server_tls_use_sni
+	server_tls_use_sni | server_edns_client_tag
 	;
 stubstart: VAR_STUB_ZONE
 	{
@@ -1175,15 +1181,15 @@ server_root_hints: VAR_ROOT_HINTS STRING_ARG
 server_dlv_anchor_file: VAR_DLV_ANCHOR_FILE STRING_ARG
 	{
 		OUTYY(("P(server_dlv_anchor_file:%s)\n", $2));
-		free(cfg_parser->cfg->dlv_anchor_file);
-		cfg_parser->cfg->dlv_anchor_file = $2;
+		log_warn("option dlv-anchor-file ignored: DLV is decommissioned");
+		free($2);
 	}
 	;
 server_dlv_anchor: VAR_DLV_ANCHOR STRING_ARG
 	{
 		OUTYY(("P(server_dlv_anchor:%s)\n", $2));
-		if(!cfg_strlist_insert(&cfg_parser->cfg->dlv_anchor_list, $2))
-			yyerror("out of memory");
+		log_warn("option dlv-anchor ignored: DLV is decommissioned");
+		free($2);
 	}
 	;
 server_auto_trust_anchor_file: VAR_AUTO_TRUST_ANCHOR_FILE STRING_ARG
@@ -2458,6 +2464,21 @@ server_ipsecmod_strict: VAR_IPSECMOD_STRICT STRING_ARG
 	#endif
 	}
 	;
+server_edns_client_tag: VAR_EDNS_CLIENT_TAG STRING_ARG STRING_ARG
+	{
+		int tag_data;
+		OUTYY(("P(server_edns_client_tag:%s %s)\n", $2, $3));
+		tag_data = atoi($3);
+		if(tag_data > 65535 || tag_data < 0 ||
+			(tag_data == 0 && (strlen($3) != 1 || $3[0] != '0')))
+			yyerror("edns-client-tag data invalid, needs to be a "
+				"number from 0 to 65535");
+		if(!cfg_str2list_insert(
+			&cfg_parser->cfg->edns_client_tags, $2, $3))
+			fatal_exit("out of memory adding "
+				"edns-client-tag");
+	}
+	;
 stub_name: VAR_NAME STRING_ARG
 	{
 		OUTYY(("P(name:%s)\n", $2));
@@ -2819,7 +2840,7 @@ dtstart: VAR_DNSTAP
 	;
 contents_dt: contents_dt content_dt
 	| ;
-content_dt: dt_dnstap_enable | dt_dnstap_socket_path |
+content_dt: dt_dnstap_enable | dt_dnstap_socket_path | dt_dnstap_bidirectional |
 	dt_dnstap_ip | dt_dnstap_tls | dt_dnstap_tls_server_name |
 	dt_dnstap_tls_cert_bundle |
 	dt_dnstap_tls_client_key_file | dt_dnstap_tls_client_cert_file |
@@ -2841,6 +2862,16 @@ dt_dnstap_enable: VAR_DNSTAP_ENABLE STRING_ARG
 		free($2);
 	}
 	;
+dt_dnstap_bidirectional: VAR_DNSTAP_BIDIRECTIONAL STRING_ARG
+	{
+		OUTYY(("P(dt_dnstap_bidirectional:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->dnstap_bidirectional =
+			(strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 dt_dnstap_socket_path: VAR_DNSTAP_SOCKET_PATH STRING_ARG
 	{
 		OUTYY(("P(dt_dnstap_socket_path:%s)\n", $2));
diff --git a/util/edns.c b/util/edns.c
index d19952df0..db33212c0 100644
--- a/util/edns.c
+++ b/util/edns.c
@@ -43,10 +43,87 @@
 #include "util/edns.h"
 #include "util/config_file.h"
 #include "util/netevent.h"
+#include "util/net_help.h"
 #include "util/regional.h"
 #include "util/data/msgparse.h"
 #include "util/data/msgreply.h"
 
+struct edns_tags* edns_tags_create(void)
+{
+	struct edns_tags* edns_tags = calloc(1, sizeof(struct edns_tags));
+	if(!edns_tags)
+		return NULL;
+	if(!(edns_tags->region = regional_create())) {
+		edns_tags_delete(edns_tags);
+		return NULL;
+	}
+	return edns_tags;
+}
+
+void edns_tags_delete(struct edns_tags* edns_tags)
+{
+	if(!edns_tags)
+		return;
+	regional_destroy(edns_tags->region);
+	free(edns_tags);
+}
+
+static int
+edns_tags_client_insert(struct edns_tags* edns_tags,
+	struct sockaddr_storage* addr, socklen_t addrlen, int net,
+	uint16_t tag_data)
+{
+	struct edns_tag_addr* eta = regional_alloc_zero(edns_tags->region,
+		sizeof(struct edns_tag_addr));
+	if(!eta)
+		return 0;
+	eta->tag_data = tag_data;
+	if(!addr_tree_insert(&edns_tags->client_tags, &eta->node, addr, addrlen,
+		net)) {
+		verbose(VERB_QUERY, "duplicate EDNS client tag ignored.");
+	}
+	return 1;
+}
+
+int edns_tags_apply_cfg(struct edns_tags* edns_tags,
+	struct config_file* config)
+{
+	struct config_str2list* c;
+	regional_free_all(edns_tags->region);
+	addr_tree_init(&edns_tags->client_tags);
+
+	for(c=config->edns_client_tags; c; c=c->next) {
+		struct sockaddr_storage addr;
+		socklen_t addrlen;
+		int net;
+		uint16_t tag_data;
+		log_assert(c->str && c->str2);
+
+		if(!netblockstrtoaddr(c->str, UNBOUND_DNS_PORT, &addr, &addrlen,
+			&net)) {
+			log_err("cannot parse EDNS client tag IP netblock: %s",
+				c->str);
+			return 0;
+		}
+		tag_data = atoi(c->str2); /* validated in config parser */
+		if(!edns_tags_client_insert(edns_tags, &addr, addrlen, net,
+			tag_data)) {
+			log_err("out of memory while adding EDNS tags");
+			return 0;
+		}
+	}
+
+	addr_tree_init_parents(&edns_tags->client_tags);
+	return 1;
+}
+
+struct edns_tag_addr*
+edns_tag_addr_lookup(rbtree_type* tree, struct sockaddr_storage* addr,
+	socklen_t addrlen)
+{
+	return (struct edns_tag_addr*)addr_tree_lookup(tree, addr, addrlen);
+}
+
 static int edns_keepalive(struct edns_data* edns_out, struct edns_data* edns_in,
 		struct comm_point* c, struct regional* region)
 {
diff --git a/util/edns.h b/util/edns.h
index a4ee7def6..c92b1ba5e 100644
--- a/util/edns.h
+++ b/util/edns.h
@@ -42,11 +42,66 @@
 #ifndef UTIL_EDNS_H
 #define UTIL_EDNS_H
 
+#include "util/storage/dnstree.h"
+
 struct edns_data;
 struct config_file;
 struct comm_point;
 struct regional;
 
+/**
+ * Structure containing all EDNS tags.
+ */
+struct edns_tags {
+	/** Tree of EDNS client tags to use in upstream queries, per address
+	 * prefix. Contains nodes of type edns_tag_addr. */
+	rbtree_type client_tags;
+	/** region to allocate tree nodes in */
+	struct regional* region;
+};
+
+/**
+ * EDNS tag. Node of rbtree, containing tag and prefix.
+ */
+struct edns_tag_addr {
+	/** node in address tree, used for tree lookups. Need to be the first
+	 * member of this struct. */
+	struct addr_tree_node node;
+	/** tag data, in host byte ordering */
+	uint16_t tag_data;
+};
+
+/**
+ * Create structure to hold EDNS tags
+ * @return: newly created edns_tags, NULL on alloc failure.
+ */
+struct edns_tags* edns_tags_create(void);
+
+/** Delete EDNS tags structure
+ * @param edns_tags: struct to delete
+ */
+void edns_tags_delete(struct edns_tags* edns_tags);
+
+/**
+ * Add configured EDNS tags
+ * @param edns_tags: edns tags to apply config to
+ * @param config: struct containing EDNS tags configuration
+ * @return 0 on error
+ */
+int edns_tags_apply_cfg(struct edns_tags* edns_tags,
+	struct config_file* config);
+
+/**
+ * Find tag for address.
+ * @param tree: tree containing EDNS tags per address prefix.
+ * @param addr: address to use for tree lookup
+ * @param addrlen: length of address
+ * @return: matching tree node, NULL otherwise
+ */
+struct edns_tag_addr*
+edns_tag_addr_lookup(rbtree_type* tree, struct sockaddr_storage* addr,
+	socklen_t addrlen);
+
 /**
  * Apply common EDNS options.
  *
diff --git a/util/mini_event.h b/util/mini_event.h
index 1734ca574..fa71ca3d1 100644
--- a/util/mini_event.h
+++ b/util/mini_event.h
@@ -54,6 +54,10 @@
 
 #if defined(USE_MINI_EVENT) && !defined(USE_WINSOCK)
 
+#ifdef	HAVE_SYS_SELECT_H
+/* for fd_set on OpenBSD */
+#include <sys/select.h>
+#endif
 #include <sys/time.h>
 
 #ifndef HAVE_EVENT_BASE_FREE
diff --git a/util/module.h b/util/module.h
index fa89c647e..1eed21300 100644
--- a/util/module.h
+++ b/util/module.h
@@ -520,6 +520,8 @@ struct module_env {
 	struct edns_known_option* edns_known_options;
 	/* Number of known edns options */
 	size_t edns_known_options_num;
+	/** EDNS client tag information */
+	struct edns_tags* edns_tags;
 
 	/* Make every mesh state unique, do not aggregate mesh states. */
 	int unique_mesh;
diff --git a/util/net_help.c b/util/net_help.c
index 908ce48d2..c5216bc2d 100644
--- a/util/net_help.c
+++ b/util/net_help.c
@@ -55,6 +55,9 @@
 #ifdef HAVE_OPENSSL_ERR_H
 #include <openssl/err.h>
 #endif
+#ifdef HAVE_OPENSSL_CORE_NAMES_H
+#include <openssl/core_names.h>
+#endif
 #ifdef USE_WINSOCK
 #include <wincrypt.h>
 #endif
@@ -82,6 +85,32 @@ static struct tls_session_ticket_key {
 	unsigned char *hmac_key;
 } *ticket_keys;
 
+#ifdef HAVE_SSL
+/**
+ * callback TLS session ticket encrypt and decrypt
+ * For use with SSL_CTX_set_tlsext_ticket_key_cb or
+ * SSL_CTX_set_tlsext_ticket_key_evp_cb
+ * @param s: the SSL_CTX to use (from connect_sslctx_create())
+ * @param key_name: secret name, 16 bytes
+ * @param iv: up to EVP_MAX_IV_LENGTH.
+ * @param evp_ctx: the evp cipher context, function sets this.
+ * @param hmac_ctx: the hmac context, function sets this.
+ * 	with ..key_cb it is of type HMAC_CTX*
+ * 	with ..key_evp_cb it is of type EVP_MAC_CTX*
+ * @param enc: 1 is encrypt, 0 is decrypt
+ * @return 0 on no ticket, 1 for okay, and 2 for okay but renew the ticket
+ * 	(the ticket is decrypt only). and <0 for failures.
+ */
+int tls_session_ticket_key_cb(SSL *s, unsigned char* key_name,
+	unsigned char* iv, EVP_CIPHER_CTX *evp_ctx,
+#ifdef HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_EVP_CB
+	EVP_MAC_CTX *hmac_ctx,
+#else
+	HMAC_CTX* hmac_ctx,
+#endif
+	int enc);
+#endif /* HAVE_SSL */
+
 /* returns true is string addr is an ip6 specced address */
 int
 str_is_ip6(const char* str)
@@ -1261,6 +1290,7 @@ int set_auth_name_on_ssl(void* ssl, char* auth_name, int use_sni)
 	}
 #else
 	(void)ssl;
+	(void)use_sni;
 #endif
 #ifdef HAVE_SSL_SET1_HOST
 	SSL_set_verify(ssl, SSL_VERIFY_PEER, NULL);
@@ -1408,10 +1438,17 @@ int listen_sslctx_setup_ticket_keys(void* sslctx, struct config_strlist* tls_ses
 	}
 	/* terminate array with NULL key name entry */
 	keys->key_name = NULL;
+#  ifdef HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_EVP_CB
+	if(SSL_CTX_set_tlsext_ticket_key_evp_cb(sslctx, tls_session_ticket_key_cb) == 0) {
+		log_err("no support for TLS session ticket");
+		return 0;
+	}
+#  else
 	if(SSL_CTX_set_tlsext_ticket_key_cb(sslctx, tls_session_ticket_key_cb) == 0) {
 		log_err("no support for TLS session ticket");
 		return 0;
 	}
+#  endif
 	return 1;
 #else
 	(void)sslctx;
@@ -1421,13 +1458,27 @@ int listen_sslctx_setup_ticket_keys(void* sslctx, struct config_strlist* tls_ses
 
 }
 
-int tls_session_ticket_key_cb(void *ATTR_UNUSED(sslctx), unsigned char* key_name, unsigned char* iv, void *evp_sctx, void *hmac_ctx, int enc)
+#ifdef HAVE_SSL
+int tls_session_ticket_key_cb(SSL *ATTR_UNUSED(sslctx), unsigned char* key_name,
+	unsigned char* iv, EVP_CIPHER_CTX *evp_sctx,
+#ifdef HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_EVP_CB
+	EVP_MAC_CTX *hmac_ctx,
+#else
+	HMAC_CTX* hmac_ctx,
+#endif
+	int enc)
 {
 #ifdef HAVE_SSL
+#  ifdef HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_EVP_CB
+	OSSL_PARAM params[3];
+#  else
 	const EVP_MD *digest;
+#  endif
 	const EVP_CIPHER *cipher;
 	int evp_cipher_length;
+#  ifndef HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_EVP_CB
 	digest = EVP_sha256();
+#  endif
 	cipher = EVP_aes_256_cbc();
 	evp_cipher_length = EVP_CIPHER_iv_length(cipher);
 	if( enc == 1 ) {
@@ -1442,7 +1493,18 @@ int tls_session_ticket_key_cb(void *ATTR_UNUSED(sslctx), unsigned char* key_name
 			verbose(VERB_CLIENT, "EVP_EncryptInit_ex failed");
 			return -1;
 		}
-#ifndef HMAC_INIT_EX_RETURNS_VOID
+#ifdef HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_EVP_CB
+		params[0] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
+			ticket_keys->hmac_key, 32);
+		params[1] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST,
+			"sha256", 0);
+		params[2] = OSSL_PARAM_construct_end();
+#ifdef HAVE_EVP_MAC_CTX_SET_PARAMS
+		EVP_MAC_CTX_set_params(hmac_ctx, params);
+#else
+		EVP_MAC_set_ctx_params(hmac_ctx, params);
+#endif
+#elif !defined(HMAC_INIT_EX_RETURNS_VOID)
 		if (HMAC_Init_ex(hmac_ctx, ticket_keys->hmac_key, 32, digest, NULL) != 1) {
 			verbose(VERB_CLIENT, "HMAC_Init_ex failed");
 			return -1;
@@ -1466,7 +1528,18 @@ int tls_session_ticket_key_cb(void *ATTR_UNUSED(sslctx), unsigned char* key_name
 			return 0;
 		}
 
-#ifndef HMAC_INIT_EX_RETURNS_VOID
+#ifdef HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_EVP_CB
+		params[0] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
+			key->hmac_key, 32);
+		params[1] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST,
+			"sha256", 0);
+		params[2] = OSSL_PARAM_construct_end();
+#ifdef HAVE_EVP_MAC_CTX_SET_PARAMS
+		EVP_MAC_CTX_set_params(hmac_ctx, params);
+#else
+		EVP_MAC_set_ctx_params(hmac_ctx, params);
+#endif
+#elif !defined(HMAC_INIT_EX_RETURNS_VOID)
 		if (HMAC_Init_ex(hmac_ctx, key->hmac_key, 32, digest, NULL) != 1) {
 			verbose(VERB_CLIENT, "HMAC_Init_ex failed");
 			return -1;
@@ -1491,6 +1564,7 @@ int tls_session_ticket_key_cb(void *ATTR_UNUSED(sslctx), unsigned char* key_name
 	return 0;
 #endif
 }
+#endif /* HAVE_SSL */
 
 void
 listen_sslctx_delete_ticket_keys(void)
@@ -1509,3 +1583,31 @@ listen_sslctx_delete_ticket_keys(void)
 	free(ticket_keys);
 	ticket_keys = NULL;
 }
+
+#  ifndef USE_WINSOCK
+char*
+sock_strerror(int errn)
+{
+	return strerror(errn);
+}
+
+void
+sock_close(int socket)
+{
+	close(socket);
+}
+
+#  else
+char*
+sock_strerror(int ATTR_UNUSED(errn))
+{
+	return wsa_strerror(WSAGetLastError());
+}
+
+void
+sock_close(int socket)
+{
+	closesocket(socket);
+}
+
+#  endif /* USE_WINSOCK */
diff --git a/util/net_help.h b/util/net_help.h
index c1bb13923..45b607a43 100644
--- a/util/net_help.h
+++ b/util/net_help.h
@@ -478,20 +478,6 @@ void ub_openssl_lock_delete(void);
 int listen_sslctx_setup_ticket_keys(void* sslctx,
 	struct config_strlist* tls_session_ticket_keys);
 
-/**
- * callback TLS session ticket encrypt and decrypt
- * For use with SSL_CTX_set_tlsext_ticket_key_cb
- * @param s: the SSL_CTX to use (from connect_sslctx_create())
- * @param key_name: secret name, 16 bytes
- * @param iv: up to EVP_MAX_IV_LENGTH.
- * @param evp_ctx: the evp cipher context, function sets this.
- * @param hmac_ctx: the hmax context, function sets this.
- * @param enc: 1 is encrypt, 0 is decrypt
- * @return 0 on no ticket, 1 for okay, and 2 for okay but renew the ticket
- * 	(the ticket is decrypt only). and <0 for failures.
- */
-int tls_session_ticket_key_cb(void *s, unsigned char* key_name,unsigned char* iv, void *evp_ctx, void *hmac_ctx, int enc);
-
 /** Free memory used for TLS session ticket keys */
 void listen_sslctx_delete_ticket_keys(void);
 
@@ -510,4 +496,10 @@ void listen_sslctx_delete_ticket_keys(void);
  */
 int netblockdnametoaddr(uint8_t* dname, size_t dnamelen,
 	struct sockaddr_storage* addr, socklen_t* addrlen, int* net, int* af);
+
+/** Return strerror or wsastrerror for socket error printout */
+char* sock_strerror(int errn);
+/** close the socket with close, or wsa closesocket */
+void sock_close(int socket);
+
 #endif /* NET_HELP_H */
diff --git a/util/netevent.c b/util/netevent.c
index 2171e3e6d..545f09742 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -373,12 +373,7 @@ comm_point_send_udp_msg(struct comm_point *c, sldns_buffer* packet,
 	if(sent == -1) {
 		if(!udp_send_errno_needs_log(addr, addrlen))
 			return 0;
-#ifndef USE_WINSOCK
-		verbose(VERB_OPS, "sendto failed: %s", strerror(errno));
-#else
-		verbose(VERB_OPS, "sendto failed: %s", 
-			wsa_strerror(WSAGetLastError()));
-#endif
+		verbose(VERB_OPS, "sendto failed: %s", sock_strerror(errno));
 		log_addr(VERB_OPS, "remote address is", 
 			(struct sockaddr_storage*)addr, addrlen);
 		return 0;
@@ -447,7 +442,10 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
 	ssize_t sent;
 	struct msghdr msg;
 	struct iovec iov[1];
-	char control[256];
+	union {
+		struct cmsghdr hdr;
+		char buf[256];
+	} control;
 #ifndef S_SPLINT_S
 	struct cmsghdr *cmsg;
 #endif /* S_SPLINT_S */
@@ -465,9 +463,9 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
 	iov[0].iov_len = sldns_buffer_remaining(packet);
 	msg.msg_iov = iov;
 	msg.msg_iovlen = 1;
-	msg.msg_control = control;
+	msg.msg_control = control.buf;
 #ifndef S_SPLINT_S
-	msg.msg_controllen = sizeof(control);
+	msg.msg_controllen = sizeof(control.buf);
 #endif /* S_SPLINT_S */
 	msg.msg_flags = 0;
 
@@ -477,7 +475,7 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
 #ifdef IP_PKTINFO
 		void* cmsg_data;
 		msg.msg_controllen = CMSG_SPACE(sizeof(struct in_pktinfo));
-		log_assert(msg.msg_controllen <= sizeof(control));
+		log_assert(msg.msg_controllen <= sizeof(control.buf));
 		cmsg->cmsg_level = IPPROTO_IP;
 		cmsg->cmsg_type = IP_PKTINFO;
 		memmove(CMSG_DATA(cmsg), &r->pktinfo.v4info,
@@ -488,7 +486,7 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
 		cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
 #elif defined(IP_SENDSRCADDR)
 		msg.msg_controllen = CMSG_SPACE(sizeof(struct in_addr));
-		log_assert(msg.msg_controllen <= sizeof(control));
+		log_assert(msg.msg_controllen <= sizeof(control.buf));
 		cmsg->cmsg_level = IPPROTO_IP;
 		cmsg->cmsg_type = IP_SENDSRCADDR;
 		memmove(CMSG_DATA(cmsg), &r->pktinfo.v4addr,
@@ -501,7 +499,7 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
 	} else if(r->srctype == 6) {
 		void* cmsg_data;
 		msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo));
-		log_assert(msg.msg_controllen <= sizeof(control));
+		log_assert(msg.msg_controllen <= sizeof(control.buf));
 		cmsg->cmsg_level = IPPROTO_IPV6;
 		cmsg->cmsg_type = IPV6_PKTINFO;
 		memmove(CMSG_DATA(cmsg), &r->pktinfo.v6info,
@@ -513,7 +511,7 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
 	} else {
 		/* try to pass all 0 to use default route */
 		msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo));
-		log_assert(msg.msg_controllen <= sizeof(control));
+		log_assert(msg.msg_controllen <= sizeof(control.buf));
 		cmsg->cmsg_level = IPPROTO_IPV6;
 		cmsg->cmsg_type = IPV6_PKTINFO;
 		memset(CMSG_DATA(cmsg), 0, sizeof(struct in6_pktinfo));
@@ -584,7 +582,10 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
 	struct msghdr msg;
 	struct iovec iov[1];
 	ssize_t rcv;
-	char ancil[256];
+	union {
+		struct cmsghdr hdr;
+		char buf[256];
+	} ancil;
 	int i;
 #ifndef S_SPLINT_S
 	struct cmsghdr* cmsg;
@@ -608,9 +609,9 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
 		iov[0].iov_len = sldns_buffer_remaining(rep.c->buffer);
 		msg.msg_iov = iov;
 		msg.msg_iovlen = 1;
-		msg.msg_control = ancil;
+		msg.msg_control = ancil.buf;
 #ifndef S_SPLINT_S
-		msg.msg_controllen = sizeof(ancil);
+		msg.msg_controllen = sizeof(ancil.buf);
 #endif /* S_SPLINT_S */
 		msg.msg_flags = 0;
 		rcv = recvmsg(fd, &msg, 0);
@@ -839,7 +840,6 @@ int comm_point_perform_accept(struct comm_point* c,
 			return -1;
 		}
 #endif
-		log_err_addr("accept failed", strerror(errno), addr, *addrlen);
 #else /* USE_WINSOCK */
 		if(WSAGetLastError() == WSAEINPROGRESS ||
 			WSAGetLastError() == WSAECONNRESET)
@@ -848,9 +848,9 @@ int comm_point_perform_accept(struct comm_point* c,
 			ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ);
 			return -1;
 		}
-		log_err_addr("accept failed", wsa_strerror(WSAGetLastError()),
-			addr, *addrlen);
 #endif
+		log_err_addr("accept failed", sock_strerror(errno), addr,
+			*addrlen);
 		return -1;
 	}
 	if(c->tcp_conn_limit && c->type == comm_tcp_accept) {
@@ -1498,8 +1498,6 @@ comm_point_tcp_handle_read(int fd, struct comm_point* c, int short_ok)
 			if(errno == ECONNRESET && verbosity < 2)
 				return 0; /* silence reset by peer */
 #endif
-			log_err_addr("read (in tcp s)", strerror(errno),
-				&c->repinfo.addr, c->repinfo.addrlen);
 #else /* USE_WINSOCK */
 			if(WSAGetLastError() == WSAECONNRESET)
 				return 0;
@@ -1510,10 +1508,9 @@ comm_point_tcp_handle_read(int fd, struct comm_point* c, int short_ok)
 					UB_EV_READ);
 				return 1;
 			}
-			log_err_addr("read (in tcp s)", 
-				wsa_strerror(WSAGetLastError()),
-				&c->repinfo.addr, c->repinfo.addrlen);
 #endif
+			log_err_addr("read (in tcp s)", sock_strerror(errno),
+				&c->repinfo.addr, c->repinfo.addrlen);
 			return 0;
 		} 
 		c->tcp_byte_count += r;
@@ -1546,8 +1543,6 @@ comm_point_tcp_handle_read(int fd, struct comm_point* c, int short_ok)
 #ifndef USE_WINSOCK
 		if(errno == EINTR || errno == EAGAIN)
 			return 1;
-		log_err_addr("read (in tcp r)", strerror(errno),
-			&c->repinfo.addr, c->repinfo.addrlen);
 #else /* USE_WINSOCK */
 		if(WSAGetLastError() == WSAECONNRESET)
 			return 0;
@@ -1557,10 +1552,9 @@ comm_point_tcp_handle_read(int fd, struct comm_point* c, int short_ok)
 			ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ);
 			return 1;
 		}
-		log_err_addr("read (in tcp r)",
-			wsa_strerror(WSAGetLastError()),
-			&c->repinfo.addr, c->repinfo.addrlen);
 #endif
+		log_err_addr("read (in tcp r)", sock_strerror(errno),
+			&c->repinfo.addr, c->repinfo.addrlen);
 		return 0;
 	}
 	sldns_buffer_skip(c->buffer, r);
@@ -1779,8 +1773,6 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
 		if(errno == ECONNRESET && verbosity < 2)
 			return 0; /* silence reset by peer */
 #endif
-		log_err_addr("tcp send r", strerror(errno),
-			&c->repinfo.addr, c->repinfo.addrlen);
 #else
 		if(WSAGetLastError() == WSAEINPROGRESS)
 			return 1;
@@ -1790,9 +1782,9 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
 		}
 		if(WSAGetLastError() == WSAECONNRESET && verbosity < 2)
 			return 0; /* silence reset by peer */
-		log_err_addr("tcp send r", wsa_strerror(WSAGetLastError()),
-			&c->repinfo.addr, c->repinfo.addrlen);
 #endif
+		log_err_addr("tcp send r", sock_strerror(errno),
+			&c->repinfo.addr, c->repinfo.addrlen);
 		return 0;
 	}
 	sldns_buffer_skip(buffer, r);
@@ -1977,8 +1969,6 @@ http_read_more(int fd, struct comm_point* c)
 #ifndef USE_WINSOCK
 		if(errno == EINTR || errno == EAGAIN)
 			return 1;
-		log_err_addr("read (in http r)", strerror(errno),
-			&c->repinfo.addr, c->repinfo.addrlen);
 #else /* USE_WINSOCK */
 		if(WSAGetLastError() == WSAECONNRESET)
 			return 0;
@@ -1988,10 +1978,9 @@ http_read_more(int fd, struct comm_point* c)
 			ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ);
 			return 1;
 		}
-		log_err_addr("read (in http r)",
-			wsa_strerror(WSAGetLastError()),
-			&c->repinfo.addr, c->repinfo.addrlen);
 #endif
+		log_err_addr("read (in http r)", sock_strerror(errno),
+			&c->repinfo.addr, c->repinfo.addrlen);
 		return 0;
 	}
 	sldns_buffer_skip(c->buffer, r);
@@ -2639,8 +2628,6 @@ http_write_more(int fd, struct comm_point* c)
 #ifndef USE_WINSOCK
 		if(errno == EINTR || errno == EAGAIN)
 			return 1;
-		log_err_addr("http send r", strerror(errno),
-			&c->repinfo.addr, c->repinfo.addrlen);
 #else
 		if(WSAGetLastError() == WSAEINPROGRESS)
 			return 1;
@@ -2648,9 +2635,9 @@ http_write_more(int fd, struct comm_point* c)
 			ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE);
 			return 1; 
 		}
-		log_err_addr("http send r", wsa_strerror(WSAGetLastError()),
-			&c->repinfo.addr, c->repinfo.addrlen);
 #endif
+		log_err_addr("http send r", sock_strerror(errno),
+			&c->repinfo.addr, c->repinfo.addrlen);
 		return 0;
 	}
 	sldns_buffer_skip(c->buffer, r);
@@ -3586,11 +3573,7 @@ comm_point_close(struct comm_point* c)
 			ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE);
 		}
 		verbose(VERB_ALGO, "close fd %d", c->fd);
-#ifndef USE_WINSOCK
-		close(c->fd);
-#else
-		closesocket(c->fd);
-#endif
+		sock_close(c->fd);
 	}
 	c->fd = -1;
 }
@@ -3759,11 +3742,7 @@ comm_point_start_listening(struct comm_point* c, int newfd, int msec)
 	}
 	if(newfd != -1) {
 		if(c->fd != -1) {
-#ifndef USE_WINSOCK
-			close(c->fd);
-#else
-			closesocket(c->fd);
-#endif
+			sock_close(c->fd);
 		}
 		c->fd = newfd;
 		ub_event_set_fd(c->ev->ev, c->fd);
diff --git a/validator/val_anchor.c b/validator/val_anchor.c
index 7224f00a2..9b6574c5d 100644
--- a/validator/val_anchor.c
+++ b/validator/val_anchor.c
@@ -1030,8 +1030,6 @@ anchors_assemble_rrsets(struct val_anchors* anchors)
 				")", b);
 			(void)rbtree_delete(anchors->tree, &ta->node);
 			lock_basic_unlock(&ta->lock);
-			if(anchors->dlv_anchor == ta)
-				anchors->dlv_anchor = NULL;
 			anchors_delfunc(&ta->node, NULL);
 			ta = next;
 			continue;
@@ -1103,37 +1101,6 @@ anchors_apply_cfg(struct val_anchors* anchors, struct config_file* cfg)
 			return 0;
 		}
 	}
-	if(cfg->dlv_anchor_file && cfg->dlv_anchor_file[0] != 0) {
-		struct trust_anchor* dlva;
-		nm = cfg->dlv_anchor_file;
-		if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(nm,
-			cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
-			nm += strlen(cfg->chrootdir);
-		if(!(dlva = anchor_read_file(anchors, parsebuf,
-			nm, 1))) {
-			log_err("error reading dlv-anchor-file: %s", 
-				cfg->dlv_anchor_file);
-			sldns_buffer_free(parsebuf);
-			return 0;
-		}
-		lock_basic_lock(&anchors->lock);
-		anchors->dlv_anchor = dlva;
-		lock_basic_unlock(&anchors->lock);
-	}
-	for(f = cfg->dlv_anchor_list; f; f = f->next) {
-		struct trust_anchor* dlva;
-		if(!f->str || f->str[0] == 0) /* empty "" */
-			continue;
-		if(!(dlva = anchor_store_str(
-			anchors, parsebuf, f->str))) {
-			log_err("error in dlv-anchor: \"%s\"", f->str);
-			sldns_buffer_free(parsebuf);
-			return 0;
-		}
-		lock_basic_lock(&anchors->lock);
-		anchors->dlv_anchor = dlva;
-		lock_basic_unlock(&anchors->lock);
-	}
 	/* do autr last, so that it sees what anchors are filled by other
 	 * means can can print errors about double config for the name */
 	for(f = cfg->auto_trust_anchor_file_list; f; f = f->next) {
diff --git a/validator/val_anchor.h b/validator/val_anchor.h
index a2a795d09..1597a7d62 100644
--- a/validator/val_anchor.h
+++ b/validator/val_anchor.h
@@ -67,8 +67,6 @@ struct val_anchors {
 	 * contents of type trust_anchor.
 	 */
 	rbtree_type* tree;
-	/** The DLV trust anchor (if one is configured, else NULL) */
-	struct trust_anchor* dlv_anchor;
 	/** Autotrust global data, anchors sorted by next probe time */
 	struct autr_global_data* autr;
 };
diff --git a/validator/val_neg.c b/validator/val_neg.c
index 4c08e6bbc..67699b1f7 100644
--- a/validator/val_neg.c
+++ b/validator/val_neg.c
@@ -965,108 +965,6 @@ static int neg_closest_data(struct val_neg_zone* zone,
 	}
 }
 
-int val_neg_dlvlookup(struct val_neg_cache* neg, uint8_t* qname, size_t len,
-        uint16_t qclass, struct rrset_cache* rrset_cache, time_t now)
-{
-	/* lookup closest zone */
-	struct val_neg_zone* zone;
-	struct val_neg_data* data;
-	int labs;
-	struct ub_packed_rrset_key* nsec;
-	struct packed_rrset_data* d;
-	uint32_t flags;
-	uint8_t* wc;
-	struct query_info qinfo;
-	if(!neg) return 0;
-
-	log_nametypeclass(VERB_ALGO, "negcache dlvlookup", qname, 
-		LDNS_RR_TYPE_DLV, qclass);
-	
-	labs = dname_count_labels(qname);
-	lock_basic_lock(&neg->lock);
-	zone = neg_closest_zone_parent(neg, qname, len, labs, qclass);
-	while(zone && !zone->in_use)
-		zone = zone->parent;
-	if(!zone) {
-		lock_basic_unlock(&neg->lock);
-		return 0;
-	}
-	log_nametypeclass(VERB_ALGO, "negcache zone", zone->name, 0, 
-		zone->dclass);
-
-	/* DLV is defined to use NSEC only */
-	if(zone->nsec3_hash) {
-		lock_basic_unlock(&neg->lock);
-		return 0;
-	}
-
-	/* lookup closest data record */
-	(void)neg_closest_data(zone, qname, len, labs, &data);
-	while(data && !data->in_use)
-		data = data->parent;
-	if(!data) {
-		lock_basic_unlock(&neg->lock);
-		return 0;
-	}
-	log_nametypeclass(VERB_ALGO, "negcache rr", data->name, 
-		LDNS_RR_TYPE_NSEC, zone->dclass);
-
-	/* lookup rrset in rrset cache */
-	flags = 0;
-	if(query_dname_compare(data->name, zone->name) == 0)
-		flags = PACKED_RRSET_NSEC_AT_APEX;
-	nsec = rrset_cache_lookup(rrset_cache, data->name, data->len,
-		LDNS_RR_TYPE_NSEC, zone->dclass, flags, now, 0);
-
-	/* check if secure and TTL ok */
-	if(!nsec) {
-		lock_basic_unlock(&neg->lock);
-		return 0;
-	}
-	d = (struct packed_rrset_data*)nsec->entry.data;
-	if(!d || now > d->ttl) {
-		lock_rw_unlock(&nsec->entry.lock);
-		/* delete data record if expired */
-		neg_delete_data(neg, data);
-		lock_basic_unlock(&neg->lock);
-		return 0;
-	}
-	if(d->security != sec_status_secure) {
-		lock_rw_unlock(&nsec->entry.lock);
-		neg_delete_data(neg, data);
-		lock_basic_unlock(&neg->lock);
-		return 0;
-	}
-	verbose(VERB_ALGO, "negcache got secure rrset");
-
-	/* check NSEC security */
-	/* check if NSEC proves no DLV type exists */
-	/* check if NSEC proves NXDOMAIN for qname */
-	qinfo.qname = qname;
-	qinfo.qtype = LDNS_RR_TYPE_DLV;
-	qinfo.qclass = qclass;
-	qinfo.local_alias = NULL;
-	if(!nsec_proves_nodata(nsec, &qinfo, &wc) &&
-		!val_nsec_proves_name_error(nsec, qname)) {
-		/* the NSEC is not a denial for the DLV */
-		lock_rw_unlock(&nsec->entry.lock);
-		lock_basic_unlock(&neg->lock);
-		verbose(VERB_ALGO, "negcache not proven");
-		return 0;
-	}
-	/* so the NSEC was a NODATA proof, or NXDOMAIN proof. */
-
-	/* no need to check for wildcard NSEC; no wildcards in DLV repos */
-	/* no need to lookup SOA record for client; no response message */
-
-	lock_rw_unlock(&nsec->entry.lock);
-	/* if OK touch the LRU for neg_data element */
-	neg_lru_touch(neg, data);
-	lock_basic_unlock(&neg->lock);
-	verbose(VERB_ALGO, "negcache DLV denial proven");
-	return 1;
-}
-
 void val_neg_addreferral(struct val_neg_cache* neg, struct reply_info* rep,
 	uint8_t* zone_name)
 {
diff --git a/validator/val_neg.h b/validator/val_neg.h
index 877f5c944..5643ca331 100644
--- a/validator/val_neg.h
+++ b/validator/val_neg.h
@@ -218,26 +218,6 @@ void val_neg_addreply(struct val_neg_cache* neg, struct reply_info* rep);
 void val_neg_addreferral(struct val_neg_cache* neg, struct reply_info* rep,
 	uint8_t* zone);
 
-/**
- * Perform a DLV style lookup
- * During the lookup, we could find out that data has expired. In that
- * case the neg_cache entries are removed, and lookup fails.
- *
- * @param neg: negative cache.
- * @param qname: name to look for
- * @param len: length of qname.
- * @param qclass: class to look in.
- * @param rrset_cache: the rrset cache, for NSEC lookups.
- * @param now: current time for ttl checks.
- * @return 
- *	0 on error
- *	0 if no proof of negative
- *	1 if indeed negative was proven
- *	  thus, qname DLV qclass does not exist.
- */
-int val_neg_dlvlookup(struct val_neg_cache* neg, uint8_t* qname, size_t len,
-	uint16_t qclass, struct rrset_cache* rrset_cache, time_t now);
-
 /**
  * For the given query, try to get a reply out of the negative cache.
  * The reply still needs to be validated.
diff --git a/validator/val_nsec.c b/validator/val_nsec.c
index a795e7733..032d2ae03 100644
--- a/validator/val_nsec.c
+++ b/validator/val_nsec.c
@@ -541,86 +541,3 @@ val_nsec_proves_no_wc(struct ub_packed_rrset_key* nsec, uint8_t* qname,
 	}
 	return 0;
 }
-
-/**
- * Find shared topdomain that exists
- */
-static void
-dlv_topdomain(struct ub_packed_rrset_key* nsec, uint8_t* qname,
-	uint8_t** nm, size_t* nm_len)
-{
-	/* make sure reply is part of nm */
-	/* take shared topdomain with left of NSEC. */
-
-	/* because, if empty nonterminal, then right is subdomain of qname.
-	 * and any shared topdomain would be empty nonterminals.
-	 * 
-	 * If nxdomain, then the right is bigger, and could have an 
-	 * interesting shared topdomain, but if it does have one, it is
-	 * an empty nonterminal. An empty nonterminal shared with the left
-	 * one. */
-	int n;
-	uint8_t* common = dname_get_shared_topdomain(qname, nsec->rk.dname);
-	n = dname_count_labels(*nm) - dname_count_labels(common);
-	dname_remove_labels(nm, nm_len, n);
-}
-
-int val_nsec_check_dlv(struct query_info* qinfo,
-        struct reply_info* rep, uint8_t** nm, size_t* nm_len)
-{
-	uint8_t* next;
-	size_t i, nlen;
-	int c;
-	/* we should now have a NOERROR/NODATA or NXDOMAIN message */
-	if(rep->an_numrrsets != 0) {
-		return 0;
-	}
-	/* is this NOERROR ? */
-	if(FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR) {
-		/* it can be a plain NSEC match - go up one more level. */
-		/* or its an empty nonterminal - go up to nonempty level */
-		for(i=0; i<rep->ns_numrrsets; i++) {
-			if(htons(rep->rrsets[i]->rk.type)!=LDNS_RR_TYPE_NSEC ||
-				!nsec_get_next(rep->rrsets[i], &next, &nlen))
-				continue;
-			c = dname_canonical_compare(
-				rep->rrsets[i]->rk.dname, qinfo->qname);
-			if(c == 0) {
-				/* plain match */
-				if(nsec_has_type(rep->rrsets[i],
-					LDNS_RR_TYPE_DLV))
-					return 0;
-				dname_remove_label(nm, nm_len);
-				return 1;
-			} else if(c < 0 && 
-				dname_strict_subdomain_c(next, qinfo->qname)) {
-				/* ENT */
-				dlv_topdomain(rep->rrsets[i], qinfo->qname,
-					nm, nm_len);
-				return 1;
-			}
-		}
-		return 0;
-	}
-
-	/* is this NXDOMAIN ? */
-	if(FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NXDOMAIN) {
-		/* find the qname denial NSEC record. It can tell us
-		 * a closest encloser name; or that we not need bother */
-		for(i=0; i<rep->ns_numrrsets; i++) {
-			if(htons(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_NSEC)
-				continue;
-			if(val_nsec_proves_name_error(rep->rrsets[i], 
-				qinfo->qname)) {
-				log_nametypeclass(VERB_ALGO, "topdomain on",
-					rep->rrsets[i]->rk.dname, 
-					ntohs(rep->rrsets[i]->rk.type), 0);
-				dlv_topdomain(rep->rrsets[i], qinfo->qname,
-					nm, nm_len);
-				return 1;
-			}
-		}
-		return 0;
-	}
-	return 0;
-}
diff --git a/validator/val_nsec.h b/validator/val_nsec.h
index 4e71257bc..7117809d6 100644
--- a/validator/val_nsec.h
+++ b/validator/val_nsec.h
@@ -158,19 +158,6 @@ uint8_t* nsec_closest_encloser(uint8_t* qname,
 int val_nsec_proves_no_wc(struct ub_packed_rrset_key* nsec, uint8_t* qname, 
 	size_t qnamelen);
 
-/**
- * Determine the DLV result, what to do with NSEC DLV reply.
- * @param qinfo: what was queried for.
- * @param rep: the nonpositive reply.
- * @param nm: dlv lookup name, to adjust for new lookup name (if needed).
- * @param nm_len: length of lookup name.
- * @return 0 on error, 1 if a higher point is found.
- * 	If the higher point is above the dlv repo anchor, the qname does 
- * 	not exist.
- */
-int val_nsec_check_dlv(struct query_info* qinfo,
-	struct reply_info* rep, uint8_t** nm, size_t* nm_len);
-
 /**
  * Determine if an nsec proves an insecure delegation towards the qname.
  * @param nsec: nsec rrset.
diff --git a/validator/val_secalgo.c b/validator/val_secalgo.c
index 3dbbe9ac9..65bca8b69 100644
--- a/validator/val_secalgo.c
+++ b/validator/val_secalgo.c
@@ -77,6 +77,10 @@ int fake_sha1 = 0;
 #include <openssl/engine.h>
 #endif
 
+#if defined(HAVE_OPENSSL_DSA_H) && defined(USE_DSA)
+#include <openssl/dsa.h>
+#endif
+
 /**
  * Output a libcrypto openssl error to the logfile.
  * @param str: string to add to it.
diff --git a/validator/validator.c b/validator/validator.c
index c3ca0a27d..e12180b4b 100644
--- a/validator/validator.c
+++ b/validator/validator.c
@@ -390,10 +390,8 @@ generate_request(struct module_qstate* qstate, int id, uint8_t* name,
 	ask.local_alias = NULL;
 	log_query_info(VERB_ALGO, "generate request", &ask);
 	/* enable valrec flag to avoid recursion to the same validation
-	 * routine, this lookup is simply a lookup. DLVs need validation */
-	if(qtype == LDNS_RR_TYPE_DLV)
-		valrec = 0;
-	else valrec = 1;
+	 * routine, this lookup is simply a lookup. */
+	valrec = 1;
 
 	fptr_ok(fptr_whitelist_modenv_detect_cycle(qstate->env->detect_cycle));
 	if((*qstate->env->detect_cycle)(qstate, &ask,
@@ -1585,7 +1583,7 @@ processInit(struct module_qstate* qstate, struct val_qstate* vq,
 	vq->key_entry = key_cache_obtain(ve->kcache, lookup_name, lookup_len,
 		vq->qchase.qclass, qstate->region, *qstate->env->now);
 
-	/* there is no key(from DLV) and no trust anchor */
+	/* there is no key and no trust anchor */
 	if(vq->key_entry == NULL && anchor == NULL) {
 		/*response isn't under a trust anchor, so we cannot validate.*/
 		vq->chase_reply->security = sec_status_indeterminate;
@@ -1603,7 +1601,6 @@ processInit(struct module_qstate* qstate, struct val_qstate* vq,
 			val_mark_insecure(vq->chase_reply, anchor->name, 
 				qstate->env->rrset_cache, qstate->env);
 			lock_basic_unlock(&anchor->lock);
-			vq->dlv_checked=1; /* skip DLV check */
 			/* go to finished state to cache this result */
 			vq->state = VAL_FINISHED_STATE;
 			return 1;
@@ -1679,9 +1676,8 @@ processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
 	/* We know that state.key_entry is not 0 or bad key -- if it were,
 	 * then previous processing should have directed this event to 
 	 * a different state. 
-	 * It could be an isnull key, which signals that a DLV was just
-	 * done and the DNSKEY after the DLV failed with dnssec-retry state
-	 * and the DNSKEY has to be performed again. */
+	 * It could be an isnull key, which signals the DNSKEY failed
+	 * with retry and has to be looked up again. */
 	log_assert(vq->key_entry && !key_entry_isbad(vq->key_entry));
 	if(key_entry_isnull(vq->key_entry)) {
 		if(!generate_request(qstate, id, vq->ds_rrset->rk.dname, 
@@ -1985,148 +1981,6 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq,
 	return 1;
 }
 
-/**
- * Init DLV check.
- * DLV is going to be decommissioned, but the code is still here for some time.
- *
- * Called when a query is determined by other trust anchors to be insecure
- * (or indeterminate).  Then we look if there is a key in the DLV.
- * Performs aggressive negative cache check to see if there is no key.
- * Otherwise, spawns a DLV query, and changes to the DLV wait state.
- *
- * @param qstate: query state.
- * @param vq: validator query state.
- * @param ve: validator shared global environment.
- * @param id: module id.
- * @return  true if there is no DLV.
- * 	false: processing is finished for the validator operate().
- * 	This function may exit in three ways:
- *         o	no DLV (aggressive cache), so insecure. (true)
- *         o	error - stop processing (false)
- *         o	DLV lookup was started, stop processing (false)
- */
-static int
-val_dlv_init(struct module_qstate* qstate, struct val_qstate* vq, 
-	struct val_env* ve, int id)
-{
-	uint8_t* nm;
-	size_t nm_len;
-	struct module_qstate* newq = NULL;
-	/* there must be a DLV configured */
-	log_assert(qstate->env->anchors->dlv_anchor);
-	/* this bool is true to avoid looping in the DLV checks */
-	log_assert(vq->dlv_checked);
-
-	/* init the DLV lookup variables */
-	vq->dlv_lookup_name = NULL;
-	vq->dlv_lookup_name_len = 0;
-	vq->dlv_insecure_at = NULL;
-	vq->dlv_insecure_at_len = 0;
-
-	/* Determine the name for which we want to lookup DLV.
-	 * This name is for the current message, or 
-	 * for the current RRset for CNAME, referral subtypes.
-	 * If there is a signer, use that, otherwise the domain name */
-	if(vq->signer_name) {
-		nm = vq->signer_name;
-		nm_len = vq->signer_len;
-	} else {
-		/* use qchase */
-		nm = vq->qchase.qname;
-		nm_len = vq->qchase.qname_len;
-		if(vq->qchase.qtype == LDNS_RR_TYPE_DS)
-			dname_remove_label(&nm, &nm_len);
-	}
-	log_nametypeclass(VERB_ALGO, "DLV init look", nm, LDNS_RR_TYPE_DS,
-		vq->qchase.qclass);
-	log_assert(nm && nm_len);
-	/* sanity check: no DLV lookups below the DLV anchor itself.
-	 * Like, an securely insecure delegation there makes no sense. */
-	if(dname_subdomain_c(nm, qstate->env->anchors->dlv_anchor->name)) {
-		verbose(VERB_ALGO, "DLV lookup within DLV repository denied");
-		return 1;
-	}
-	/* concat name (minus root label) + dlv name */
-	vq->dlv_lookup_name_len = nm_len - 1 + 
-		qstate->env->anchors->dlv_anchor->namelen;
-	vq->dlv_lookup_name = regional_alloc(qstate->region, 
-		vq->dlv_lookup_name_len);
-	if(!vq->dlv_lookup_name) {
-		log_err("Out of memory preparing DLV lookup");
-		return val_error(qstate, id);
-	}
-	memmove(vq->dlv_lookup_name, nm, nm_len-1);
-	memmove(vq->dlv_lookup_name+nm_len-1, 
-		qstate->env->anchors->dlv_anchor->name, 
-		qstate->env->anchors->dlv_anchor->namelen);
-	log_nametypeclass(VERB_ALGO, "DLV name", vq->dlv_lookup_name, 
-		LDNS_RR_TYPE_DLV, vq->qchase.qclass);
-
-	/* determine where the insecure point was determined, the DLV must 
-	 * be equal or below that to continue building the trust chain 
-	 * down. May be NULL if no trust chain was built yet */
-	nm = NULL;
-	if(vq->key_entry && key_entry_isnull(vq->key_entry)) {
-		nm = vq->key_entry->name;
-		nm_len = vq->key_entry->namelen;
-	}
-	if(nm) {
-		vq->dlv_insecure_at_len = nm_len - 1 +
-			qstate->env->anchors->dlv_anchor->namelen;
-		vq->dlv_insecure_at = regional_alloc(qstate->region,
-			vq->dlv_insecure_at_len);
-		if(!vq->dlv_insecure_at) {
-			log_err("Out of memory preparing DLV lookup");
-			return val_error(qstate, id);
-		}
-		memmove(vq->dlv_insecure_at, nm, nm_len-1);
-		memmove(vq->dlv_insecure_at+nm_len-1, 
-			qstate->env->anchors->dlv_anchor->name, 
-			qstate->env->anchors->dlv_anchor->namelen);
-		log_nametypeclass(VERB_ALGO, "insecure_at", 
-			vq->dlv_insecure_at, 0, vq->qchase.qclass);
-	}
-
-	/* If we can find the name in the aggressive negative cache,
-	 * give up; insecure is the answer */
-	while(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name,
-		vq->dlv_lookup_name_len, vq->qchase.qclass,
-		qstate->env->rrset_cache, *qstate->env->now)) {
-		/* go up */
-		dname_remove_label(&vq->dlv_lookup_name, 
-			&vq->dlv_lookup_name_len);
-		/* too high? */
-		if(!dname_subdomain_c(vq->dlv_lookup_name,
-			qstate->env->anchors->dlv_anchor->name)) {
-			verbose(VERB_ALGO, "ask above dlv repo");
-			return 1; /* Above the repo is insecure */
-		}
-		/* above chain of trust? */
-		if(vq->dlv_insecure_at && !dname_subdomain_c(
-			vq->dlv_lookup_name, vq->dlv_insecure_at)) {
-			verbose(VERB_ALGO, "ask above insecure endpoint");
-			return 1;
-		}
-	}
-
-	/* perform a lookup for the DLV; with validation */
-	vq->state = VAL_DLVLOOKUP_STATE;
-	if(!generate_request(qstate, id, vq->dlv_lookup_name, 
-		vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV,
-		vq->qchase.qclass, 0, &newq, 0)) {
-		return val_error(qstate, id);
-	}
-
-	/* Find the closest encloser DLV from the repository.
-	 * then that is used to build another chain of trust 
-	 * This may first require a query 'too low' that has NSECs in
-	 * the answer, from which we determine the closest encloser DLV. 
-	 * When determine the closest encloser, skip empty nonterminals,
-	 * since we want a nonempty node in the DLV repository. */
-
-	return 0;
-}
-
 /**
  * The Finished state. The validation status (good or bad) has been determined.
  *
@@ -2145,16 +1999,6 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
 		qstate->query_flags, &qstate->qinfo, &vq->qchase, 
 		vq->orig_msg->rep, vq->rrset_skip);
 
-	/* if the result is insecure or indeterminate and we have not 
-	 * checked the DLV yet, check the DLV */
-	if((vq->chase_reply->security == sec_status_insecure ||
-		vq->chase_reply->security == sec_status_indeterminate) &&
-		qstate->env->anchors->dlv_anchor && !vq->dlv_checked) {
-		vq->dlv_checked = 1;
-		if(!val_dlv_init(qstate, vq, ve, id))
-			return 0;
-	}
-
 	/* store overall validation result in orig_msg */
 	if(vq->rrset_skip == 0)
 		vq->orig_msg->rep->security = vq->chase_reply->security;
@@ -2177,7 +2021,6 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
 			/* and restart for this rrset */
 			verbose(VERB_ALGO, "validator: go to next rrset");
 			vq->chase_reply->security = sec_status_unchecked;
-			vq->dlv_checked = 0; /* can do DLV for this RR */
 			vq->state = VAL_INIT_STATE;
 			return 1;
 		}
@@ -2195,7 +2038,6 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
 			log_query_info(VERB_ALGO, "validator: chased to",
 				&vq->qchase);
 			vq->chase_reply->security = sec_status_unchecked;
-			vq->dlv_checked = 0; /* can do DLV for this RR */
 			vq->state = VAL_INIT_STATE;
 			return 1;
 		}
@@ -2321,119 +2163,6 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
 	return 0;
 }
 
-/**
- * The DLVLookup state. Process DLV lookups.
- *
- * @param qstate: query state.
- * @param vq: validator query state.
- * @param ve: validator shared global environment.
- * @param id: module id.
- * @return true if the event should be processed further on return, false if
- *         not.
- */
-static int
-processDLVLookup(struct module_qstate* qstate, struct val_qstate* vq, 
-	struct val_env* ve, int id)
-{
-	struct module_qstate* newq = NULL;
-	/* see if this we are ready to continue normal resolution */
-	/* we may need more DLV lookups */
-	if(vq->dlv_status==dlv_error)
-		verbose(VERB_ALGO, "DLV woke up with status dlv_error");
-	else if(vq->dlv_status==dlv_success)
-		verbose(VERB_ALGO, "DLV woke up with status dlv_success");
-	else if(vq->dlv_status==dlv_ask_higher)
-		verbose(VERB_ALGO, "DLV woke up with status dlv_ask_higher");
-	else if(vq->dlv_status==dlv_there_is_no_dlv)
-		verbose(VERB_ALGO, "DLV woke up with status dlv_there_is_no_dlv");
-	else 	verbose(VERB_ALGO, "DLV woke up with status unknown");
-
-	if(vq->dlv_status == dlv_error) {
-		verbose(VERB_QUERY, "failed DLV lookup");
-		errinf(qstate, "failed DLV lookup");
-		return val_error(qstate, id);
-	} else if(vq->dlv_status == dlv_success) {
-		uint8_t* nm;
-		size_t nmlen;
-		/* chain continues with DNSKEY, continue in FINDKEY */
-		vq->state = VAL_FINDKEY_STATE;
-
-		/* strip off the DLV suffix from the name; could result in . */
-		log_assert(dname_subdomain_c(vq->ds_rrset->rk.dname,
-			qstate->env->anchors->dlv_anchor->name));
-		nmlen = vq->ds_rrset->rk.dname_len -
-			qstate->env->anchors->dlv_anchor->namelen + 1;
-		nm = regional_alloc_init(qstate->region, 
-			vq->ds_rrset->rk.dname, nmlen);
-		if(!nm) {
-			log_err("Out of memory in DLVLook");
-			return val_error(qstate, id);
-		}
-		nm[nmlen-1] = 0;
-
-		vq->ds_rrset->rk.dname = nm;
-		vq->ds_rrset->rk.dname_len = nmlen;
-
-		/* create a nullentry for the key so the dnskey lookup
-		 * can be retried after a validation failure for it */
-		vq->key_entry = key_entry_create_null(qstate->region,
-			nm, nmlen, vq->qchase.qclass, 0, 0);
-		if(!vq->key_entry) {
-			log_err("Out of memory in DLVLook");
-			return val_error(qstate, id);
-		}
-
-		if(!generate_request(qstate, id, vq->ds_rrset->rk.dname, 
-			vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY, 
-			vq->qchase.qclass, BIT_CD, &newq, 0)) {
-			verbose(VERB_ALGO, "error generating DNSKEY request");
-			return val_error(qstate, id);
-		}
-		return 0;
-	} else if(vq->dlv_status == dlv_there_is_no_dlv) {
-		/* continue with the insecure result we got */
-		vq->state = VAL_FINISHED_STATE;
-		return 1;
-	} 
-	log_assert(vq->dlv_status == dlv_ask_higher);
-
-	/* ask higher, make sure we stay in DLV repo, below dlv_at */
-	if(!dname_subdomain_c(vq->dlv_lookup_name,
-		qstate->env->anchors->dlv_anchor->name)) {
-		/* just like, there is no DLV */
-		verbose(VERB_ALGO, "ask above dlv repo");
-		vq->state = VAL_FINISHED_STATE;
-		return 1;
-	}
-	if(vq->dlv_insecure_at && !dname_subdomain_c(vq->dlv_lookup_name,
-		vq->dlv_insecure_at)) {
-		/* already checked a chain lower than dlv_lookup_name */
-		verbose(VERB_ALGO, "ask above insecure endpoint");
-		log_nametypeclass(VERB_ALGO, "enpt", vq->dlv_insecure_at, 0, 0);
-		vq->state = VAL_FINISHED_STATE;
-		return 1;
-	}
-
-	/* check negative cache before making new request */
-	if(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name,
-		vq->dlv_lookup_name_len, vq->qchase.qclass,
-		qstate->env->rrset_cache, *qstate->env->now)) {
-		/* does not exist, go up one (go higher). */
-		dname_remove_label(&vq->dlv_lookup_name, 
-			&vq->dlv_lookup_name_len);
-		/* limit number of labels, limited number of recursion */
-		return processDLVLookup(qstate, vq, ve, id);
-	}
-
-	if(!generate_request(qstate, id, vq->dlv_lookup_name,
-		vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV, 
-		vq->qchase.qclass, 0, &newq, 0)) {
-		return val_error(qstate, id);
-	}
-
-	return 0;
-}
-
 /** 
  * Handle validator state.
  * If a method returns true, the next state is started. If false, then
@@ -2464,9 +2193,6 @@ val_handle(struct module_qstate* qstate, struct val_qstate* vq,
 			case VAL_FINISHED_STATE: 
 				cont = processFinished(qstate, vq, ve, id);
 				break;
-			case VAL_DLVLOOKUP_STATE: 
-				cont = processDLVLookup(qstate, vq, ve, id);
-				break;
 			default:
 				log_warn("validator: invalid state %d",
 					vq->state);
@@ -3105,99 +2831,6 @@ process_prime_response(struct module_qstate* qstate, struct val_qstate* vq,
 	/* the qstate will be reactivated after inform_super is done */
 }
 
-/**
- * Process DLV response. Called from inform_supers.
- * Because it is in inform_supers, the mesh itself is busy doing callbacks
- * for a state that is to be deleted soon; don't touch the mesh; instead
- * set a state in the super, as the super will be reactivated soon.
- * Perform processing to determine what state to set in the super.
- *
- * @param qstate: query state that is validating and asked for a DLV.
- * @param vq: validator query state
- * @param id: module id.
- * @param rcode: rcode result value.
- * @param msg: result message (if rcode is OK).
- * @param qinfo: from the sub query state, query info.
- */
-static void
-process_dlv_response(struct module_qstate* qstate, struct val_qstate* vq,
-	int id, int rcode, struct dns_msg* msg, struct query_info* qinfo)
-{
-	struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
-
-	verbose(VERB_ALGO, "process dlv response to super");
-	if(rcode != LDNS_RCODE_NOERROR) {
-		/* lookup failed, set in vq to give up */
-		vq->dlv_status = dlv_error;
-		verbose(VERB_ALGO, "response is error");
-		return;
-	}
-	if(msg->rep->security != sec_status_secure) {
-		vq->dlv_status = dlv_error;
-		verbose(VERB_ALGO, "response is not secure, %s",
-			sec_status_to_string(msg->rep->security));
-		return;
-	}
-	/* was the lookup a success? validated DLV? */
-	if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_NOERROR &&
-		msg->rep->an_numrrsets == 1 &&
-		msg->rep->security == sec_status_secure &&
-		ntohs(msg->rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_DLV &&
-		ntohs(msg->rep->rrsets[0]->rk.rrset_class) == qinfo->qclass &&
-		query_dname_compare(msg->rep->rrsets[0]->rk.dname, 
-			vq->dlv_lookup_name) == 0) {
-		/* yay! it is just like a DS */
-		vq->ds_rrset = (struct ub_packed_rrset_key*)
-			regional_alloc_init(qstate->region,
-			msg->rep->rrsets[0], sizeof(*vq->ds_rrset));
-		if(!vq->ds_rrset) {
-			log_err("out of memory in process_dlv");
-			return;
-		}
-		vq->ds_rrset->entry.key = vq->ds_rrset;
-		vq->ds_rrset->rk.dname = (uint8_t*)regional_alloc_init(
-			qstate->region, vq->ds_rrset->rk.dname, 
-			vq->ds_rrset->rk.dname_len);
-		if(!vq->ds_rrset->rk.dname) {
-			log_err("out of memory in process_dlv");
-			vq->dlv_status = dlv_error;
-			return;
-		}
-		vq->ds_rrset->entry.data = regional_alloc_init(qstate->region,
-			vq->ds_rrset->entry.data, 
-			packed_rrset_sizeof(vq->ds_rrset->entry.data));
-		if(!vq->ds_rrset->entry.data) {
-			log_err("out of memory in process_dlv");
-			vq->dlv_status = dlv_error;
-			return;
-		}
-		packed_rrset_ptr_fixup(vq->ds_rrset->entry.data);
-		/* make vq do a DNSKEY query next up */
-		vq->dlv_status = dlv_success;
-		return;
-	}
-	/* store NSECs into negative cache */
-	val_neg_addreply(ve->neg_cache, msg->rep);
-
-	/* was the lookup a failure? 
-	 *   if we have to go up into the DLV for a higher DLV anchor
-	 *   then set this in the vq, so it can make queries when activated.
-	 * See if the NSECs indicate that we should look for higher DLV
-	 * or, that there is no DLV securely */
-	if(!val_nsec_check_dlv(qinfo, msg->rep, &vq->dlv_lookup_name, 
-		&vq->dlv_lookup_name_len)) {
-		vq->dlv_status = dlv_error;
-		verbose(VERB_ALGO, "nsec error");
-		return;
-	}
-	if(!dname_subdomain_c(vq->dlv_lookup_name, 
-		qstate->env->anchors->dlv_anchor->name)) {
-		vq->dlv_status = dlv_there_is_no_dlv;
-		return;
-	}
-	vq->dlv_status = dlv_ask_higher;
-}
-
 /* 
  * inform validator super.
  * 
@@ -3233,10 +2866,6 @@ val_inform_super(struct module_qstate* qstate, int id,
 			qstate->return_msg, &qstate->qinfo,
 			qstate->reply_origin);
 		return;
-	} else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DLV) {
-		process_dlv_response(super, vq, id, qstate->return_rcode,
-			qstate->return_msg, &qstate->qinfo);
-		return;
 	}
 	log_err("internal error in validator: no inform_supers possible");
 }
@@ -3284,7 +2913,6 @@ val_state_to_string(enum val_state state)
 		case VAL_FINDKEY_STATE: return "VAL_FINDKEY_STATE";
 		case VAL_VALIDATE_STATE: return "VAL_VALIDATE_STATE";
 		case VAL_FINISHED_STATE: return "VAL_FINISHED_STATE";
-		case VAL_DLVLOOKUP_STATE: return "VAL_DLVLOOKUP_STATE";
 	}
 	return "UNKNOWN VALIDATOR STATE";
 }
diff --git a/validator/validator.h b/validator/validator.h
index 9e4c8a941..35da1920a 100644
--- a/validator/validator.h
+++ b/validator/validator.h
@@ -137,8 +137,6 @@ enum val_state {
 	VAL_VALIDATE_STATE,
 	/** finish up */
 	VAL_FINISHED_STATE,
-	/** DLV lookup state, processing DLV queries */
-	VAL_DLVLOOKUP_STATE
 };
 
 /**
@@ -217,27 +215,6 @@ struct val_qstate {
 
 	/** true if this state is waiting to prime a trust anchor */
 	int wait_prime_ta;
-
-	/** have we already checked the DLV? */
-	int dlv_checked;
-	/** The name for which the DLV is looked up. For the current message
-	 * or for the current RRset (for CNAME, REFERRAL types).
-	 * If there is signer name, that may be it, else a domain name */
-	uint8_t* dlv_lookup_name;
-	/** length of dlv lookup name */
-	size_t dlv_lookup_name_len;
-	/** Name at which chain of trust stopped with insecure, starting DLV
-	 * DLV must result in chain going further down */
-	uint8_t* dlv_insecure_at;
-	/** length of dlv insecure point name */
-	size_t dlv_insecure_at_len;
-	/** status of DLV lookup. Indication to VAL_DLV_STATE what to do */
-	enum dlv_status {
-		dlv_error, /* server failure */
-		dlv_success, /* got a DLV */
-		dlv_ask_higher, /* ask again */
-		dlv_there_is_no_dlv /* got no DLV, sure of it */
-	} dlv_status;
 };
 
 /**