From 9fb65e2b9edbcf6c739686710a3347de3cd890b1 Mon Sep 17 00:00:00 2001
From: Florian Obser <florian@narrans.de>
Date: Wed, 28 Oct 2020 14:15:23 +0100
Subject: [PATCH 01/44] Sprinkle in some static to prevent missing prototype
 warnings.

---
 util/netevent.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/util/netevent.c b/util/netevent.c
index 2428417fa..974c59996 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -2248,7 +2248,7 @@ http_chunked_segment(struct comm_point* c)
 
 #ifdef HAVE_NGHTTP2
 /** Create new http2 session. Called when creating handling comm point. */
-struct http2_session* http2_session_create(struct comm_point* c)
+static struct http2_session* http2_session_create(struct comm_point* c)
 {
 	struct http2_session* session = calloc(1, sizeof(*session));
 	if(!session) {
@@ -2262,7 +2262,7 @@ struct http2_session* http2_session_create(struct comm_point* c)
 #endif
 
 /** Delete http2 session. After closing connection or on error */
-void http2_session_delete(struct http2_session* h2_session)
+static void http2_session_delete(struct http2_session* h2_session)
 {
 #ifdef HAVE_NGHTTP2
 	if(h2_session->callbacks)
@@ -2338,7 +2338,7 @@ void http2_session_add_stream(struct http2_session* h2_session,
 
 /** remove stream from session linked list. After stream close callback or
  * closing connection */
-void http2_session_remove_stream(struct http2_session* h2_session,
+static void http2_session_remove_stream(struct http2_session* h2_session,
 	struct http2_stream* h2_stream)
 {
 	if(h2_stream->prev)

From eb052e15434f933202b3067fc3fc68eaacdb6311 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Wed, 2 Dec 2020 11:51:54 +0100
Subject: [PATCH 02/44] - Fix unbound-dnstap-socket to not use log routine from
 interrupt   handler and not print so frequently when invoked in sequence.

---
 dnstap/unbound-dnstap-socket.c | 3 ++-
 doc/Changelog                  | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/dnstap/unbound-dnstap-socket.c b/dnstap/unbound-dnstap-socket.c
index 3ebe2b4e4..8c37654e8 100644
--- a/dnstap/unbound-dnstap-socket.c
+++ b/dnstap/unbound-dnstap-socket.c
@@ -1166,7 +1166,8 @@ int sig_quit = 0;
 /** signal handler for user quit */
 static RETSIGTYPE main_sigh(int sig)
 {
-	verbose(VERB_ALGO, "exit on signal %d\n", sig);
+	if(!sig_quit)
+		fprintf(stderr, "exit on signal %d\n", sig);
 	if(sig_base) {
 		ub_event_base_loopexit(sig_base);
 		sig_base = NULL;
diff --git a/doc/Changelog b/doc/Changelog
index 405060fc4..9bb31615f 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -3,6 +3,8 @@
 	  connections fail, in that case we print a hint that this is
 	  happening with the error in the logs.
 	- Fix #356: deadlock when listening tcp.
+	- Fix unbound-dnstap-socket to not use log routine from interrupt
+	  handler and not print so frequently when invoked in sequence.
 
 1 December 2020: Wouter
 	- Fix #358: Squelch udp connect 'no route to host' errors on low

From e049fb303c39eef9cda4a70c6e161819d7e08ffd Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Wed, 2 Dec 2020 11:58:24 +0100
Subject: [PATCH 03/44] - Fix on windows to ignore connection failure on UDP,
 unless verbose.

---
 doc/Changelog   |  1 +
 util/netevent.c | 11 ++++++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/doc/Changelog b/doc/Changelog
index 9bb31615f..9d055b5df 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -5,6 +5,7 @@
 	- Fix #356: deadlock when listening tcp.
 	- Fix unbound-dnstap-socket to not use log routine from interrupt
 	  handler and not print so frequently when invoked in sequence.
+	- Fix on windows to ignore connection failure on UDP, unless verbose.
 
 1 December 2020: Wouter
 	- Fix #358: Squelch udp connect 'no route to host' errors on low
diff --git a/util/netevent.c b/util/netevent.c
index 98796a788..e7a674f8a 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -583,6 +583,7 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
 static int udp_recv_needs_log(int err)
 {
 	switch(err) {
+#ifndef USE_WINSOCK
 	case ECONNREFUSED:
 #  ifdef ENETUNREACH
 	case ENETUNREACH:
@@ -596,6 +597,13 @@ static int udp_recv_needs_log(int err)
 #  ifdef ENETDOWN
 	case ENETDOWN:
 #  endif
+#else /* USE_WINSOCK */
+	case WSAECONNREFUSED:
+	case WSAENETUNREACH:
+	case WSAEHOSTDOWN:
+	case WSAEHOSTUNREACH:
+	case WSAENETDOWN:
+#endif
 		if(verbosity >= VERB_ALGO)
 			return 1;
 		return 0;
@@ -736,7 +744,8 @@ comm_point_udp_callback(int fd, short event, void* arg)
 #else
 			if(WSAGetLastError() != WSAEINPROGRESS &&
 				WSAGetLastError() != WSAECONNRESET &&
-				WSAGetLastError()!= WSAEWOULDBLOCK)
+				WSAGetLastError()!= WSAEWOULDBLOCK &&
+				udp_recv_needs_log(WSAGetLastError()))
 				log_err("recvfrom failed: %s",
 					wsa_strerror(WSAGetLastError()));
 #endif

From 0502ab3026af59673b21133eb7c5a72126b37d66 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Wed, 2 Dec 2020 15:42:24 +0100
Subject: [PATCH 04/44] - Fix for #283: fix stream reuse and tcp fast open.

---
 doc/Changelog   | 1 +
 util/netevent.c | 6 +++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/doc/Changelog b/doc/Changelog
index 9d055b5df..890e439fe 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -6,6 +6,7 @@
 	- Fix unbound-dnstap-socket to not use log routine from interrupt
 	  handler and not print so frequently when invoked in sequence.
 	- Fix on windows to ignore connection failure on UDP, unless verbose.
+	- Fix for #283: fix stream reuse and tcp fast open.
 
 1 December 2020: Wouter
 	- Fix #358: Squelch udp connect 'no route to host' errors on low
diff --git a/util/netevent.c b/util/netevent.c
index e7a674f8a..eca2df83f 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -2064,7 +2064,11 @@ comm_point_tcp_handle_callback(int fd, short event, void* arg)
 		}
 		return;
 	}
-	if(event&UB_EV_READ) {
+	if(event&UB_EV_READ
+#ifdef USE_MSG_FASTOPEN
+		&& !c->tcp_do_fastopen
+#endif
+		) {
 		int has_tcpq = (c->tcp_req_info != NULL);
 		int* moreread = c->tcp_more_read_again;
 		if(!comm_point_tcp_handle_read(fd, c, 0)) {

From 9eeb95a960460399d66f13fca02fb50464c50e10 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Wed, 2 Dec 2020 16:17:26 +0100
Subject: [PATCH 05/44] - Fix update, with write event check with streamreuse
 and fastopen.

---
 doc/Changelog   | 1 +
 util/netevent.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/Changelog b/doc/Changelog
index 890e439fe..4b6a4a318 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -7,6 +7,7 @@
 	  handler and not print so frequently when invoked in sequence.
 	- Fix on windows to ignore connection failure on UDP, unless verbose.
 	- Fix for #283: fix stream reuse and tcp fast open.
+	- Fix update, with write event check with streamreuse and fastopen.
 
 1 December 2020: Wouter
 	- Fix #358: Squelch udp connect 'no route to host' errors on low
diff --git a/util/netevent.c b/util/netevent.c
index eca2df83f..d3e268a01 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -2066,7 +2066,7 @@ comm_point_tcp_handle_callback(int fd, short event, void* arg)
 	}
 	if(event&UB_EV_READ
 #ifdef USE_MSG_FASTOPEN
-		&& !c->tcp_do_fastopen
+		&& !(c->tcp_do_fastopen && (event&UB_EV_WRITE))
 #endif
 		) {
 		int has_tcpq = (c->tcp_req_info != NULL);

From 37d751e1353b19dac1025c9b3a64c14812346ebc Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Thu, 3 Dec 2020 10:14:14 +0100
Subject: [PATCH 06/44] Code repo continues for 1.13.1 in development.

---
 configure     | 25 +++++++++++++------------
 configure.ac  |  5 +++--
 doc/Changelog |  4 +++-
 3 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/configure b/configure
index 7fa20f987..00d36a361 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for unbound 1.13.0.
+# Generated by GNU Autoconf 2.69 for unbound 1.13.1.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues>.
 #
@@ -591,8 +591,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.13.0'
-PACKAGE_STRING='unbound 1.13.0'
+PACKAGE_VERSION='1.13.1'
+PACKAGE_STRING='unbound 1.13.1'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues'
 PACKAGE_URL=''
 
@@ -1459,7 +1459,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 1.13.0 to adapt to many kinds of systems.
+\`configure' configures unbound 1.13.1 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1524,7 +1524,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.13.0:";;
+     short | recursive ) echo "Configuration of unbound 1.13.1:";;
    esac
   cat <<\_ACEOF
 
@@ -1752,7 +1752,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 1.13.0
+unbound configure 1.13.1
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2461,7 +2461,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 1.13.0, which was
+It was created by unbound $as_me 1.13.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2813,11 +2813,11 @@ UNBOUND_VERSION_MAJOR=1
 
 UNBOUND_VERSION_MINOR=13
 
-UNBOUND_VERSION_MICRO=0
+UNBOUND_VERSION_MICRO=1
 
 
 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=11
+LIBUNBOUND_REVISION=12
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -2896,6 +2896,7 @@ LIBUNBOUND_AGE=1
 # 1.11.0 had 9:9:1
 # 1.12.0 had 9:10:1
 # 1.13.0 had 9:11:1
+# 1.13.1 had 9:12:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -21731,7 +21732,7 @@ _ACEOF
 
 
 
-version=1.13.0
+version=1.13.1
 
 date=`date +'%b %e, %Y'`
 
@@ -22250,7 +22251,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.13.0, which was
+This file was extended by unbound $as_me 1.13.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -22316,7 +22317,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-unbound config.status 1.13.0
+unbound config.status 1.13.1
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff --git a/configure.ac b/configure.ac
index 5385f7747..d648f55ad 100644
--- a/configure.ac
+++ b/configure.ac
@@ -11,14 +11,14 @@ sinclude(dnscrypt/dnscrypt.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[13])
-m4_define([VERSION_MICRO],[0])
+m4_define([VERSION_MICRO],[1])
 AC_INIT(unbound, m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]), unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues, unbound)
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
 
 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=11
+LIBUNBOUND_REVISION=12
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -97,6 +97,7 @@ LIBUNBOUND_AGE=1
 # 1.11.0 had 9:9:1
 # 1.12.0 had 9:10:1
 # 1.13.0 had 9:11:1
+# 1.13.1 had 9:12:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
diff --git a/doc/Changelog b/doc/Changelog
index 4b6a4a318..d8ffabd52 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -17,7 +17,9 @@
 	- Fix assertion failure on double callback when iterator loses
 	  interest in query at head of line that then has the tcp stream
 	  not kept for reuse.
-	- tag for the 1.13.0rc4 release.
+	- tag for the 1.13.0rc4 release.  This also became the 1.13.0
+	  release version with the streamreuse and fastopen fix from
+	  2 dec 2020.  The code repo continues for 1.13.1 in development.
 
 27 November 2020: Wouter
 	- Fix compile warning for type cast in http2_submit_dns_response.

From e21d38dcb9da0d500c0f1e988c72d21f17245598 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Thu, 3 Dec 2020 10:26:37 +0100
Subject: [PATCH 07/44] - make depend.

---
 Makefile.in   | 489 +++++++++++++++++++++++++++++---------------------
 doc/Changelog |   8 +-
 2 files changed, 289 insertions(+), 208 deletions(-)

diff --git a/Makefile.in b/Makefile.in
index d2600e71f..4ca46496b 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -429,6 +429,7 @@ dnstap.pb-c.lo dnstap.pb-c.o: dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h
 dtstream.lo dtstream.o: $(srcdir)/dnstap/dtstream.c config.h $(srcdir)/dnstap/dtstream.h
 dnstap_fstrm.lo dnstap_fstrm.o: $(srcdir)/dnstap/dnstap_fstrm.c config.h $(srcdir)/dnstap/dnstap_fstrm.h
 unbound-dnstap-socket.lo unbound-dnstap-socket.o: $(srcdir)/dnstap/unbound-dnstap-socket.c config.h $(srcdir)/dnstap/dtstream.h
+dynlibmod.lo dynlibdmod.o: $(srcdir)/dynlibmod/dynlibmod.c config.h $(srcdir)/dynlibmod/dynlibmod.h
 
 # dnscrypt
 dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h \
@@ -826,13 +827,16 @@ modstack.lo modstack.o: $(srcdir)/services/modstack.c config.h $(srcdir)/service
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
- $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/dns64/dns64.h \
- $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/validator/validator.h \
- $(srcdir)/validator/val_utils.h $(srcdir)/respip/respip.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(PYTHONMOD_HEADER) $(srcdir)/ipsecmod/ipsecmod.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h \
- $(srcdir)/ipset/ipset.h $(srcdir)/dynlibmod/dynlibmod.h
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/tube.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/dns64/dns64.h $(srcdir)/iterator/iterator.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
+ $(PYTHONMOD_HEADER) $(DYNLIBMOD_HEADER) $(srcdir)/cachedb/cachedb.h \
+ $(srcdir)/ipsecmod/ipsecmod.h $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/util/alloc.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/util/data/dname.h $(srcdir)/edns-subnet/addrtree.h \
+ $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/ipset/ipset.h
 view.lo view.o: $(srcdir)/services/view.c config.h $(srcdir)/services/view.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
@@ -863,7 +867,8 @@ outside_network.lo outside_network.o: $(srcdir)/services/outside_network.c confi
  $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
  $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h \
  $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
- $(srcdir)/dnstap/dnstap.h
+ $(srcdir)/util/edns.h $(srcdir)/dnstap/dnstap.h \
+ 
 alloc.lo alloc.o: $(srcdir)/util/alloc.c config.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/regional.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
@@ -884,7 +889,8 @@ config_file.lo config_file.o: $(srcdir)/util/config_file.c config.h $(srcdir)/ut
  $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
  $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/rtt.h $(srcdir)/services/cache/infra.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h \
- $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/util/iana_ports.inc
+ $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/edns-subnet/edns-subnet.h \
+ $(srcdir)/util/iana_ports.inc
 configlexer.lo configlexer.o: util/configlexer.c config.h $(srcdir)/util/configyyrename.h \
  $(srcdir)/util/config_file.h util/configparser.h
 configparser.lo configparser.o: util/configparser.c config.h $(srcdir)/util/configyyrename.h \
@@ -913,38 +919,31 @@ authzone.lo authzone.o: $(srcdir)/services/authzone.c config.h $(srcdir)/service
  $(srcdir)/util/data/msgencode.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
  $(srcdir)/services/cache/dns.h $(srcdir)/services/outside_network.h  \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h \
- $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/keyraw.h $(srcdir)/validator/val_nsec3.h \
- $(srcdir)/validator/val_secalgo.h
+ $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_secalgo.h
 fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/util/mini_event.h \
- $(srcdir)/services/outside_network.h  $(srcdir)/services/localzone.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/services/authzone.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h $(srcdir)/iterator/iterator.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/validator/validator.h \
- $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_nsec3.h \
- $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_neg.h \
- $(srcdir)/validator/autotrust.h $(srcdir)/libunbound/libworker.h $(srcdir)/libunbound/context.h \
- $(srcdir)/util/alloc.h $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h \
- $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/respip/respip.h \
- $(PYTHONMOD_HEADER) $(srcdir)/ipsecmod/ipsecmod.h $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/util/net_help.h \
- $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/ipset/ipset.h \
- $(srcdir)/dynlibmod/dynlibmod.h
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/mini_event.h \
+ $(srcdir)/services/outside_network.h  $(srcdir)/services/cache/infra.h \
+ $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h \
+ $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h \
+ $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h \
+ $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h \
+ $(srcdir)/validator/val_neg.h $(srcdir)/validator/autotrust.h $(srcdir)/libunbound/libworker.h \
+ $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/libunbound/unbound-event.h \
+ $(srcdir)/libunbound/worker.h $(PYTHONMOD_HEADER) $(DYNLIBMOD_HEADER) \
+ $(srcdir)/cachedb/cachedb.h $(srcdir)/ipsecmod/ipsecmod.h $(srcdir)/edns-subnet/subnetmod.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/edns-subnet/addrtree.h \
+ $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/ipset/ipset.h $(srcdir)/dnstap/dtstream.h
 locks.lo locks.o: $(srcdir)/util/locks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
 log.lo log.o: $(srcdir)/util/log.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/sldns/sbuffer.h
-mini_event.lo mini_event.o: $(srcdir)/util/mini_event.c config.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/util/log.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
- $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
- $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
+mini_event.lo mini_event.o: $(srcdir)/util/mini_event.c config.h $(srcdir)/util/mini_event.h
 module.lo module.o: $(srcdir)/util/module.c config.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
@@ -957,12 +956,14 @@ netevent.lo netevent.o: $(srcdir)/util/netevent.c config.h $(srcdir)/util/neteve
  $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
  $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
  $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/sldns/str2wire.h \
- $(srcdir)/dnstap/dnstap.h  $(srcdir)/services/listen_dnsport.h
+ $(srcdir)/dnstap/dnstap.h  $(srcdir)/services/listen_dnsport.h \
+ 
 net_help.lo net_help.o: $(srcdir)/util/net_help.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/module.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h \
- $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h
+ $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h \
+ 
 random.lo random.o: $(srcdir)/util/random.c config.h $(srcdir)/util/random.h $(srcdir)/util/log.h
 rbtree.lo rbtree.o: $(srcdir)/util/rbtree.c config.h $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
@@ -978,11 +979,11 @@ rtt.lo rtt.o: $(srcdir)/util/rtt.c config.h $(srcdir)/util/rtt.h $(srcdir)/itera
  $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h
-edns.lo edns.o: $(srcdir)/util/edns.c config.h $(srcdir)/util/edns.h $(srcdir)/util/config_file.h \
- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/util/regional.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/packed_rrset.h
+edns.lo edns.o: $(srcdir)/util/edns.c config.h $(srcdir)/util/edns.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/util/rbtree.h $(srcdir)/util/config_file.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+  $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/regional.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h
 dnstree.lo dnstree.o: $(srcdir)/util/storage/dnstree.c config.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/util/net_help.h
@@ -1016,7 +1017,8 @@ tube.lo tube.o: $(srcdir)/util/tube.c config.h $(srcdir)/util/tube.h $(srcdir)/u
  $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/ub_event.h
 ub_event.lo ub_event.o: $(srcdir)/util/ub_event.c config.h $(srcdir)/util/ub_event.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/util/tube.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
+ $(srcdir)/util/tube.h \
+ 
 ub_event_pluggable.lo ub_event_pluggable.o: $(srcdir)/util/ub_event_pluggable.c config.h $(srcdir)/util/ub_event.h \
  $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
   $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h \
@@ -1026,7 +1028,8 @@ ub_event_pluggable.lo ub_event_pluggable.o: $(srcdir)/util/ub_event_pluggable.c
  $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
+ 
 winsock_event.lo winsock_event.o: $(srcdir)/util/winsock_event.c config.h
 autotrust.lo autotrust.o: $(srcdir)/validator/autotrust.c config.h $(srcdir)/validator/autotrust.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
@@ -1039,7 +1042,8 @@ autotrust.lo autotrust.o: $(srcdir)/validator/autotrust.c config.h $(srcdir)/val
  $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/respip/respip.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/validator/val_kcache.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/keyraw.h
+ $(srcdir)/validator/val_kcache.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/keyraw.h \
+ 
 val_anchor.lo val_anchor.o: $(srcdir)/validator/val_anchor.c config.h $(srcdir)/validator/val_anchor.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_sigcrypt.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h \
@@ -1069,11 +1073,13 @@ val_kcache.lo val_kcache.o: $(srcdir)/validator/val_kcache.c config.h $(srcdir)/
 val_kentry.lo val_kentry.o: $(srcdir)/validator/val_kentry.c config.h $(srcdir)/validator/val_kentry.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h
-val_neg.lo val_neg.o: $(srcdir)/validator/val_neg.c config.h $(srcdir)/validator/val_neg.h $(srcdir)/util/locks.h \
- $(srcdir)/util/log.h $(srcdir)/util/rbtree.h $(srcdir)/validator/val_nsec.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_utils.h \
- $(srcdir)/sldns/pkthdr.h $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/net_help.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
+ 
+val_neg.lo val_neg.o: $(srcdir)/validator/val_neg.c config.h \
+ $(srcdir)/validator/val_neg.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/validator/val_nsec.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_utils.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/config_file.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/services/cache/dns.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h
 val_nsec3.lo val_nsec3.o: $(srcdir)/validator/val_nsec3.c config.h $(srcdir)/validator/val_nsec3.h \
@@ -1091,15 +1097,17 @@ val_nsec.lo val_nsec.o: $(srcdir)/validator/val_nsec.c config.h $(srcdir)/valida
 val_secalgo.lo val_secalgo.o: $(srcdir)/validator/val_secalgo.c config.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_secalgo.h \
  $(srcdir)/validator/val_nsec3.h $(srcdir)/util/rbtree.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
- $(srcdir)/sldns/sbuffer.h
+ $(srcdir)/sldns/sbuffer.h \
+ 
 val_sigcrypt.lo val_sigcrypt.o: $(srcdir)/validator/val_sigcrypt.c config.h \
  $(srcdir)/validator/val_sigcrypt.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h $(srcdir)/validator/val_secalgo.h \
  $(srcdir)/validator/validator.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/rbtree.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
- $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h \
- $(srcdir)/sldns/wire2str.h
+ $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h \
+ 
 val_utils.lo val_utils.o: $(srcdir)/validator/val_utils.c config.h $(srcdir)/validator/val_utils.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/validator/validator.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
@@ -1120,15 +1128,43 @@ dns64.lo dns64.o: $(srcdir)/dns64/dns64.c config.h $(srcdir)/dns64/dns64.h $(src
  $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
  $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/str2wire.h
-edns-subnet.lo edns-subnet.o: $(srcdir)/edns-subnet/edns-subnet.c config.h
-subnetmod.lo subnetmod.o: $(srcdir)/edns-subnet/subnetmod.c config.h
+edns-subnet.lo edns-subnet.o: $(srcdir)/edns-subnet/edns-subnet.c config.h \
+ $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h
+subnetmod.lo subnetmod.o: $(srcdir)/edns-subnet/subnetmod.c config.h $(srcdir)/edns-subnet/subnetmod.h \
+ $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/outbound_list.h $(srcdir)/util/alloc.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h \
+ $(srcdir)/edns-subnet/subnet-whitelist.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+  $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h \
+ $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/respip/respip.h $(srcdir)/services/cache/dns.h $(srcdir)/util/regional.h \
+ $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h
 addrtree.lo addrtree.o: $(srcdir)/edns-subnet/addrtree.c config.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/edns-subnet/addrtree.h
-subnet-whitelist.lo subnet-whitelist.o: $(srcdir)/edns-subnet/subnet-whitelist.c config.h
-cachedb.lo cachedb.o: $(srcdir)/cachedb/cachedb.c config.h
-redis.lo redis.o: $(srcdir)/cachedb/redis.c config.h
+subnet-whitelist.lo subnet-whitelist.o: $(srcdir)/edns-subnet/subnet-whitelist.c config.h \
+ $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
+ $(srcdir)/edns-subnet/subnet-whitelist.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h
+cachedb.lo cachedb.o: $(srcdir)/cachedb/cachedb.c config.h $(srcdir)/cachedb/cachedb.h $(srcdir)/util/module.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/cachedb/redis.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/data/msgencode.h $(srcdir)/services/cache/dns.h \
+ $(srcdir)/validator/val_neg.h $(srcdir)/util/rbtree.h $(srcdir)/validator/val_secalgo.h \
+ $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h $(srcdir)/sldns/parseutil.h \
+ $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/sbuffer.h
+redis.lo redis.o: $(srcdir)/cachedb/redis.c config.h $(srcdir)/cachedb/redis.h $(srcdir)/cachedb/cachedb.h \
+ $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/alloc.h $(srcdir)/util/config_file.h \
+ $(srcdir)/sldns/sbuffer.h
 respip.lo respip.o: $(srcdir)/respip/respip.c config.h $(srcdir)/services/localzone.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/module.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
@@ -1143,31 +1179,40 @@ checklocks.lo checklocks.o: $(srcdir)/testcode/checklocks.c config.h $(srcdir)/u
  $(srcdir)/testcode/checklocks.h
 dnstap.lo dnstap.o: $(srcdir)/dnstap/dnstap.c  config.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
- $(srcdir)/util/locks.h $(srcdir)/dnstap/dnstap.h \
- dnstap/dnstap.pb-c.h
+ $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnstap/dnstap.h \
+ $(srcdir)/dnstap/dtstream.h $(srcdir)/util/locks.h dnstap/dnstap.pb-c.h
 dnstap.pb-c.lo dnstap.pb-c.o: dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h \
  
-dynlibmod.lo dynlibmod.o: $(srcdir)/dynlibmod/dynlibmod.c config.h $(srcdir)/dynlibmod/dynlibmod.h \
+dnstap_fstrm.lo dnstap_fstrm.o: $(srcdir)/dnstap/dnstap_fstrm.c config.h $(srcdir)/dnstap/dnstap_fstrm.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h
+dtstream.lo dtstream.o: $(srcdir)/dnstap/dtstream.c config.h $(srcdir)/dnstap/dtstream.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/log.h $(srcdir)/dnstap/dnstap_fstrm.h $(srcdir)/util/config_file.h $(srcdir)/util/ub_event.h \
+ $(srcdir)/util/net_help.h $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h $(srcdir)/util/netevent.h \
+ $(srcdir)/dnscrypt/dnscrypt.h   \
+ $(srcdir)/sldns/sbuffer.h \
+ 
+ipsecmod.lo ipsecmod.o: $(srcdir)/ipsecmod/ipsecmod.c config.h $(srcdir)/ipsecmod/ipsecmod.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/rbtree.h\
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/rbtree.h $(srcdir)/ipsecmod/ipsecmod-whitelist.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
  $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/config_file.h $(srcdir)/services/cache/dns.h $(srcdir)/sldns/wire2str.h
-dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
- $(srcdir)/util/locks.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/storage/lookup3.h
-ipsecmod.lo ipsecmod.o: $(srcdir)/ipsecmod/ipsecmod.c config.h
+ $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/services/cache/dns.h $(srcdir)/sldns/wire2str.h
+ipsecmod-whitelist.lo ipsecmod-whitelist.o: $(srcdir)/ipsecmod/ipsecmod-whitelist.c config.h \
+ $(srcdir)/ipsecmod/ipsecmod.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/ipsecmod/ipsecmod-whitelist.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/regional.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/str2wire.h
 ipset.lo ipset.o: $(srcdir)/ipset/ipset.c config.h $(srcdir)/ipset/ipset.h $(srcdir)/util/module.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/services/cache/dns.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h
-ipsecmod-whitelist.lo ipsecmod-whitelist.o: $(srcdir)/ipsecmod/ipsecmod-whitelist.c config.h
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h
 unitanchor.lo unitanchor.o: $(srcdir)/testcode/unitanchor.c config.h $(srcdir)/util/log.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h
@@ -1176,7 +1221,8 @@ unitdname.lo unitdname.o: $(srcdir)/testcode/unitdname.c config.h $(srcdir)/util
  $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h
 unitlruhash.lo unitlruhash.o: $(srcdir)/testcode/unitlruhash.c config.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/util/log.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/storage/slabhash.h
-unitmain.lo unitmain.o: $(srcdir)/testcode/unitmain.c config.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
+unitmain.lo unitmain.o: $(srcdir)/testcode/unitmain.c config.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
  $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/rtt.h $(srcdir)/util/timehist.h $(srcdir)/iterator/iterator.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
@@ -1184,7 +1230,8 @@ unitmain.lo unitmain.o: $(srcdir)/testcode/unitmain.c config.h $(srcdir)/sldns/r
  $(srcdir)/sldns/pkthdr.h $(srcdir)/libunbound/unbound.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
   $(srcdir)/util/random.h $(srcdir)/respip/respip.h \
- $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h
+ $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/services/outside_network.h 
 unitmsgparse.lo unitmsgparse.o: $(srcdir)/testcode/unitmsgparse.c config.h $(srcdir)/util/log.h \
  $(srcdir)/testcode/unitmain.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
@@ -1216,7 +1263,13 @@ testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcod
 unitldns.lo unitldns.o: $(srcdir)/testcode/unitldns.c config.h $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h \
  $(srcdir)/sldns/parseutil.h
-unitecs.lo unitecs.o: $(srcdir)/testcode/unitecs.c config.h
+unitecs.lo unitecs.o: $(srcdir)/testcode/unitecs.c config.h $(srcdir)/util/log.h $(srcdir)/util/module.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/testcode/unitmain.h $(srcdir)/edns-subnet/addrtree.h \
+ $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/services/outbound_list.h $(srcdir)/util/alloc.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/edns-subnet/edns-subnet.h
 unitauth.lo unitauth.o: $(srcdir)/testcode/unitauth.c config.h $(srcdir)/services/authzone.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
  $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/data/msgparse.h \
@@ -1233,40 +1286,43 @@ acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/ac
  $(srcdir)/services/localzone.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h
-cachedump.lo cachedump.o: $(srcdir)/daemon/cachedump.c config.h $(srcdir)/daemon/cachedump.h \
- $(srcdir)/daemon/remote.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/dns.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h \
- $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/iterator/iterator.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_utils.h \
- $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
- $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
-daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h \
- $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
-  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
+cachedump.lo cachedump.o: $(srcdir)/daemon/cachedump.c config.h \
+ $(srcdir)/daemon/cachedump.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
  $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+  $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h \
  $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
- $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/util/shm_side/shm_main.h \
- $(srcdir)/util/storage/lookup3.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/tcp_conn_limit.h \
+  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
+ $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h \
+ $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/sldns/wire2str.h \
+ $(srcdir)/sldns/str2wire.h
+daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
+ $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
+   $(srcdir)/daemon/worker.h \
+ $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
+ $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/shm_side/shm_main.h $(srcdir)/util/storage/lookup3.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/util/tcp_conn_limit.h $(srcdir)/util/edns.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/rtt.h $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
  $(srcdir)/services/rpz.h $(srcdir)/respip/respip.h $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
  $(srcdir)/sldns/keyraw.h
-remote.lo remote.o: $(srcdir)/daemon/remote.c config.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/worker.h \
- $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/alloc.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
- $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
+remote.lo remote.o: $(srcdir)/daemon/remote.c config.h \
+ $(srcdir)/daemon/remote.h \
+ $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
  $(srcdir)/services/modstack.h $(srcdir)/daemon/cachedump.h $(srcdir)/util/config_file.h \
  $(srcdir)/util/net_help.h $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
@@ -1291,19 +1347,21 @@ stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(s
  $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
- $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h
+ $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h $(srcdir)/edns-subnet/subnetmod.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h \
+ 
 unbound.lo unbound.o: $(srcdir)/daemon/unbound.c config.h $(srcdir)/util/log.h $(srcdir)/daemon/daemon.h \
  $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
-  $(srcdir)/daemon/remote.h $(srcdir)/util/config_file.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
- $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
- $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/ub_event.h
+  $(srcdir)/daemon/remote.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h
 worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
@@ -1311,23 +1369,24 @@ worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(sr
  $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
- $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
- $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/services/outside_network.h $(srcdir)/services/outbound_list.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
- $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
- $(srcdir)/services/localzone.h $(srcdir)/respip/respip.h $(srcdir)/util/data/msgencode.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/edns.h \
- $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/validator/autotrust.h \
- $(srcdir)/validator/val_anchor.h $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound-event.h \
- $(srcdir)/libunbound/libworker.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/shm_side/shm_main.h \
- $(srcdir)/dnstap/dtstream.h
+ $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
+ $(srcdir)/util/rtt.h $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
+ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/respip/respip.h \
+ $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/edns.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
+ $(srcdir)/validator/autotrust.h $(srcdir)/validator/val_anchor.h $(srcdir)/libunbound/context.h \
+ $(srcdir)/libunbound/unbound-event.h $(srcdir)/libunbound/libworker.h $(srcdir)/sldns/wire2str.h \
+ $(srcdir)/util/shm_side/shm_main.h $(srcdir)/dnstap/dtstream.h
 testbound.lo testbound.o: $(srcdir)/testcode/testbound.c config.h $(srcdir)/testcode/testpkts.h \
  $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
   $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h \
- $(srcdir)/daemon/remote.h $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/daemon/unbound.c \
- $(srcdir)/util/log.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
+ $(srcdir)/daemon/remote.h \
+ $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/daemon/unbound.c $(srcdir)/util/log.h \
+ $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
   $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
@@ -1346,34 +1405,35 @@ worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(sr
  $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
- $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
- $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/services/outside_network.h $(srcdir)/services/outbound_list.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
- $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
- $(srcdir)/services/localzone.h $(srcdir)/respip/respip.h $(srcdir)/util/data/msgencode.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/edns.h \
- $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/validator/autotrust.h \
- $(srcdir)/validator/val_anchor.h $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound-event.h \
- $(srcdir)/libunbound/libworker.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/shm_side/shm_main.h \
- $(srcdir)/dnstap/dtstream.h
+ $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
+ $(srcdir)/util/rtt.h $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
+ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/respip/respip.h \
+ $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/edns.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
+ $(srcdir)/validator/autotrust.h $(srcdir)/validator/val_anchor.h $(srcdir)/libunbound/context.h \
+ $(srcdir)/libunbound/unbound-event.h $(srcdir)/libunbound/libworker.h $(srcdir)/sldns/wire2str.h \
+ $(srcdir)/util/shm_side/shm_main.h $(srcdir)/dnstap/dtstream.h
 acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/acl_list.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
  $(srcdir)/services/localzone.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h
-daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h \
- $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
-  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h \
- $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
- $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/util/shm_side/shm_main.h \
- $(srcdir)/util/storage/lookup3.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/tcp_conn_limit.h \
+daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
+ $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
+   $(srcdir)/daemon/worker.h \
+ $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
+ $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/shm_side/shm_main.h $(srcdir)/util/storage/lookup3.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/util/tcp_conn_limit.h $(srcdir)/util/edns.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/rtt.h $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
  $(srcdir)/services/rpz.h $(srcdir)/respip/respip.h $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
@@ -1391,7 +1451,9 @@ stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(s
  $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
- $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h
+ $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h $(srcdir)/edns-subnet/subnetmod.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h \
+ 
 replay.lo replay.o: $(srcdir)/testcode/replay.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/config_file.h $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
   $(srcdir)/testcode/testpkts.h $(srcdir)/util/rbtree.h \
@@ -1401,13 +1463,14 @@ fake_event.lo fake_event.o: $(srcdir)/testcode/fake_event.c config.h $(srcdir)/t
  $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/config_file.h $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
- $(srcdir)/util/rbtree.h  $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h $(srcdir)/testcode/replay.h $(srcdir)/testcode/testpkts.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
+ $(srcdir)/util/edns.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/config_file.h \
+ $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
+  $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/testcode/replay.h $(srcdir)/testcode/testpkts.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
+ $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
 lock_verify.lo lock_verify.o: $(srcdir)/testcode/lock_verify.c config.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
   $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
@@ -1442,7 +1505,8 @@ unbound-checkconf.lo unbound-checkconf.o: $(srcdir)/smallapp/unbound-checkconf.c
  $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
  $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/sldns/str2wire.h \
+ $(PYTHONMOD_HEADER) $(srcdir)/edns-subnet/subnet-whitelist.h
 worker_cb.lo worker_cb.o: $(srcdir)/smallapp/worker_cb.c config.h $(srcdir)/libunbound/context.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/data/packed_rrset.h \
@@ -1463,76 +1527,83 @@ context.lo context.o: $(srcdir)/libunbound/context.c config.h $(srcdir)/libunbou
  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
  $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/daemon/stats.h \
- $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h
+ $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h $(srcdir)/util/edns.h
 libunbound.lo libunbound.o: $(srcdir)/libunbound/libunbound.c $(srcdir)/libunbound/unbound.h \
  $(srcdir)/libunbound/unbound-event.h config.h $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/libunbound/libworker.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h \
- $(srcdir)/util/random.h $(srcdir)/util/net_help.h $(srcdir)/util/tube.h $(srcdir)/util/ub_event.h \
- $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
+ $(srcdir)/util/random.h $(srcdir)/util/net_help.h $(srcdir)/util/tube.h $(srcdir)/util/ub_event.h $(srcdir)/util/edns.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
  $(srcdir)/sldns/sbuffer.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h \
  $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
  $(srcdir)/services/rpz.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h
-libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h $(srcdir)/libunbound/libworker.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
- $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/services/outside_network.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h   \
- $(srcdir)/services/mesh.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
- $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outbound_list.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/regional.h $(srcdir)/util/random.h \
- $(srcdir)/util/storage/lookup3.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/data/msgencode.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
- $(srcdir)/sldns/str2wire.h
+libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h \
+ $(srcdir)/libunbound/libworker.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h \
+ $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/outside_network.h \
+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+  $(srcdir)/services/mesh.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outbound_list.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/tube.h $(srcdir)/util/regional.h $(srcdir)/util/random.h $(srcdir)/util/storage/lookup3.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h \
+ $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/sldns/str2wire.h
 unbound-host.lo unbound-host.o: $(srcdir)/smallapp/unbound-host.c config.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h \
+ 
 asynclook.lo asynclook.o: $(srcdir)/testcode/asynclook.c config.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
  $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/rrdef.h
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/rrdef.h \
+ 
 streamtcp.lo streamtcp.o: $(srcdir)/testcode/streamtcp.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h \
+ 
 perf.lo perf.o: $(srcdir)/testcode/perf.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
 delayer.lo delayer.o: $(srcdir)/testcode/delayer.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
  $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h
-unbound-control.lo unbound-control.o: $(srcdir)/smallapp/unbound-control.c config.h $(srcdir)/util/log.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h $(srcdir)/util/shm_side/shm_main.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/sldns/wire2str.h \
- $(srcdir)/sldns/pkthdr.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/rbtree.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+unbound-control.lo unbound-control.o: $(srcdir)/smallapp/unbound-control.c config.h \
+ $(srcdir)/util/log.h $(srcdir)/util/config_file.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/shm_side/shm_main.h $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/pkthdr.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/util/rbtree.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/module.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
   $(srcdir)/services/modstack.h $(srcdir)/respip/respip.h
 unbound-anchor.lo unbound-anchor.o: $(srcdir)/smallapp/unbound-anchor.c config.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/parseutil.h
-petal.lo petal.o: $(srcdir)/testcode/petal.c config.h
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/parseutil.h \
+ 
+petal.lo petal.o: $(srcdir)/testcode/petal.c config.h \
+ 
 unbound-dnstap-socket.lo unbound-dnstap-socket.o: $(srcdir)/dnstap/unbound-dnstap-socket.c config.h \
  $(srcdir)/dnstap/dtstream.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/dnstap/dnstap_fstrm.h \
  $(srcdir)/util/ub_event.h $(srcdir)/util/net_help.h $(srcdir)/services/listen_dnsport.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/config_file.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h \
+ dnstap/dnstap.pb-c.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h
 pythonmod_utils.lo pythonmod_utils.o: $(srcdir)/pythonmod/pythonmod_utils.c config.h $(srcdir)/util/module.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
   $(srcdir)/util/net_help.h $(srcdir)/services/cache/dns.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/regional.h \
- $(srcdir)/iterator/iter_delegpt.h $(srcdir)/sldns/sbuffer.h
+ $(srcdir)/iterator/iter_delegpt.h $(srcdir)/sldns/sbuffer.h \
+ 
 win_svc.lo win_svc.o: $(srcdir)/winrc/win_svc.c config.h $(srcdir)/winrc/win_svc.h $(srcdir)/winrc/w_inst.h \
  $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
    $(srcdir)/daemon/worker.h \
@@ -1540,8 +1611,8 @@ win_svc.lo win_svc.o: $(srcdir)/winrc/win_svc.c config.h $(srcdir)/winrc/win_svc
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
- $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h $(srcdir)/util/config_file.h $(srcdir)/util/ub_event.h \
- $(srcdir)/util/net_help.h
+ $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/ub_event.h $(srcdir)/util/net_help.h
 w_inst.lo w_inst.o: $(srcdir)/winrc/w_inst.c config.h $(srcdir)/winrc/w_inst.h $(srcdir)/winrc/win_svc.h
 unbound-service-install.lo unbound-service-install.o: $(srcdir)/winrc/unbound-service-install.c config.h \
  $(srcdir)/winrc/w_inst.h
@@ -1549,12 +1620,14 @@ unbound-service-remove.lo unbound-service-remove.o: $(srcdir)/winrc/unbound-serv
  $(srcdir)/winrc/w_inst.h
 anchor-update.lo anchor-update.o: $(srcdir)/winrc/anchor-update.c config.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/wire2str.h
-keyraw.lo keyraw.o: $(srcdir)/sldns/keyraw.c config.h $(srcdir)/sldns/keyraw.h $(srcdir)/sldns/rrdef.h
+keyraw.lo keyraw.o: $(srcdir)/sldns/keyraw.c config.h $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/sldns/rrdef.h \
+ 
 sbuffer.lo sbuffer.o: $(srcdir)/sldns/sbuffer.c config.h $(srcdir)/sldns/sbuffer.h
 wire2str.lo wire2str.o: $(srcdir)/sldns/wire2str.c config.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/sldns/keyraw.h $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/util/log.h
+ $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
 parse.lo parse.o: $(srcdir)/sldns/parse.c config.h $(srcdir)/sldns/parse.h $(srcdir)/sldns/parseutil.h \
  $(srcdir)/sldns/sbuffer.h
 parseutil.lo parseutil.o: $(srcdir)/sldns/parseutil.c config.h $(srcdir)/sldns/parseutil.h
@@ -1562,9 +1635,11 @@ rrdef.lo rrdef.o: $(srcdir)/sldns/rrdef.c config.h $(srcdir)/sldns/rrdef.h $(src
 str2wire.lo str2wire.o: $(srcdir)/sldns/str2wire.c config.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parse.h $(srcdir)/sldns/parseutil.h
 dohclient.lo dohclient.o: $(srcdir)/testcode/dohclient.c config.h $(srcdir)/sldns/wire2str.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgencode.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/net_help.h
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/parseutil.h \
+ $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/util/net_help.h \
+ 
 ctime_r.lo ctime_r.o: $(srcdir)/compat/ctime_r.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
 fake-rfc2553.lo fake-rfc2553.o: $(srcdir)/compat/fake-rfc2553.c $(srcdir)/compat/fake-rfc2553.h config.h
 gmtime_r.lo gmtime_r.o: $(srcdir)/compat/gmtime_r.c config.h
@@ -1579,9 +1654,11 @@ strlcat.lo strlcat.o: $(srcdir)/compat/strlcat.c config.h
 strlcpy.lo strlcpy.o: $(srcdir)/compat/strlcpy.c config.h
 strptime.lo strptime.o: $(srcdir)/compat/strptime.c config.h
 getentropy_freebsd.lo getentropy_freebsd.o: $(srcdir)/compat/getentropy_freebsd.c
-getentropy_linux.lo getentropy_linux.o: $(srcdir)/compat/getentropy_linux.c config.h
+getentropy_linux.lo getentropy_linux.o: $(srcdir)/compat/getentropy_linux.c config.h \
+ 
 getentropy_osx.lo getentropy_osx.o: $(srcdir)/compat/getentropy_osx.c
-getentropy_solaris.lo getentropy_solaris.o: $(srcdir)/compat/getentropy_solaris.c config.h
+getentropy_solaris.lo getentropy_solaris.o: $(srcdir)/compat/getentropy_solaris.c config.h \
+ 
 getentropy_win.lo getentropy_win.o: $(srcdir)/compat/getentropy_win.c
 explicit_bzero.lo explicit_bzero.o: $(srcdir)/compat/explicit_bzero.c config.h
 arc4random.lo arc4random.o: $(srcdir)/compat/arc4random.c config.h $(srcdir)/compat/chacha_private.h
diff --git a/doc/Changelog b/doc/Changelog
index d8ffabd52..e1753a2db 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+3 December 2020: Wouter
+	- make depend.
+
 2 December 2020: Wouter
 	- Fix #360: for the additionally reported TCP Fast Open makes TCP
 	  connections fail, in that case we print a hint that this is
@@ -18,8 +21,9 @@
 	  interest in query at head of line that then has the tcp stream
 	  not kept for reuse.
 	- tag for the 1.13.0rc4 release.  This also became the 1.13.0
-	  release version with the streamreuse and fastopen fix from
-	  2 dec 2020.  The code repo continues for 1.13.1 in development.
+	  release version on 3 dec 2020 with the streamreuse and fastopen
+	  fix from 2 dec 2020.  The code repo continues for 1.13.1 in
+	  development.
 
 27 November 2020: Wouter
 	- Fix compile warning for type cast in http2_submit_dns_response.

From b49cc2e66797dcf66c991bd7ff1d4986642bb088 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Thu, 3 Dec 2020 10:27:19 +0100
Subject: [PATCH 08/44] - iana portlist updated.

---
 doc/Changelog       | 1 +
 util/iana_ports.inc | 1 +
 2 files changed, 2 insertions(+)

diff --git a/doc/Changelog b/doc/Changelog
index e1753a2db..3aaa19338 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,5 +1,6 @@
 3 December 2020: Wouter
 	- make depend.
+	- iana portlist updated.
 
 2 December 2020: Wouter
 	- Fix #360: for the additionally reported TCP Fast Open makes TCP
diff --git a/util/iana_ports.inc b/util/iana_ports.inc
index d9978f92e..adeafc4ad 100644
--- a/util/iana_ports.inc
+++ b/util/iana_ports.inc
@@ -2014,6 +2014,7 @@
 2368,
 2370,
 2372,
+2378,
 2381,
 2382,
 2383,

From a4fc32809cee523acfa9a3b82a9f5d6d46006e98 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Fri, 11 Dec 2020 09:33:56 +0100
Subject: [PATCH 09/44] - Fix #371: unbound-control timeout when Unbound is not
 running.

---
 doc/Changelog              |   3 ++
 smallapp/unbound-control.c | 106 +++++++++++++++++++++++++++++++------
 2 files changed, 94 insertions(+), 15 deletions(-)

diff --git a/doc/Changelog b/doc/Changelog
index 3aaa19338..af111d8a0 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+11 December 2020: Wouter
+	- Fix #371: unbound-control timeout when Unbound is not running.
+
 3 December 2020: Wouter
 	- make depend.
 	- iana portlist updated.
diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
index 842dbe0d8..93281736a 100644
--- a/smallapp/unbound-control.c
+++ b/smallapp/unbound-control.c
@@ -82,6 +82,9 @@ static void usage(void) ATTR_NORETURN;
 static void ssl_err(const char* s) ATTR_NORETURN;
 static void ssl_path_err(const char* s, const char *path) ATTR_NORETURN;
 
+/** timeout to wait for connection over stream, in msec */
+#define UNBOUND_CONTROL_CONNECT_TIMEOUT 5000
+
 /** Give unbound-control usage, and exit (1). */
 static void
 usage(void)
@@ -545,6 +548,30 @@ setup_ctx(struct config_file* cfg)
 	return ctx;
 }
 
+/** check connect error */
+static void
+checkconnecterr(int err, const char* svr, struct sockaddr_storage* addr,
+	socklen_t addrlen, int statuscmd, int useport)
+{
+#ifndef USE_WINSOCK
+	if(!useport) log_err("connect: %s for %s", strerror(err), svr);
+	else log_err_addr("connect", strerror(err), addr, addrlen);
+	if(err == ECONNREFUSED && statuscmd) {
+		printf("unbound is stopped\n");
+		exit(3);
+	}
+#else
+	int wsaerr = err;
+	if(!useport) log_err("connect: %s for %s", wsa_strerror(wsaerr), svr);
+	else log_err_addr("connect", wsa_strerror(wsaerr), addr, addrlen);
+	if(wsaerr == WSAECONNREFUSED && statuscmd) {
+		printf("unbound is stopped\n");
+		exit(3);
+	}
+#endif
+	exit(1);
+}
+
 /** contact the server with TCP connect */
 static int
 contact_server(const char* svr, struct config_file* cfg, int statuscmd)
@@ -598,26 +625,75 @@ contact_server(const char* svr, struct config_file* cfg, int statuscmd)
 	if(fd == -1) {
 		fatal_exit("socket: %s", sock_strerror(errno));
 	}
+	fd_set_nonblock(fd);
 	if(connect(fd, (struct sockaddr*)&addr, addrlen) < 0) {
 #ifndef USE_WINSOCK
-		int err = errno;
-		if(!useport) log_err("connect: %s for %s", strerror(err), svr);
-		else log_err_addr("connect", strerror(err), &addr, addrlen);
-		if(err == ECONNREFUSED && statuscmd) {
-			printf("unbound is stopped\n");
-			exit(3);
-		}
-#else
-		int wsaerr = WSAGetLastError();
-		if(!useport) log_err("connect: %s for %s", wsa_strerror(wsaerr), svr);
-		else log_err_addr("connect", wsa_strerror(wsaerr), &addr, addrlen);
-		if(wsaerr == WSAECONNREFUSED && statuscmd) {
-			printf("unbound is stopped\n");
-			exit(3);
+#ifdef EINPROGRESS
+		if(errno != EINPROGRESS) {
+			checkconnecterr(errno, svr, &addr,
+				addrlen, statuscmd, useport);
+		}
+#endif
+#else
+		if(WSAGetLastError() != WSAEINPROGRESS &&
+			WSAGetLastError() != WSAEWOULDBLOCK) {
+			checkconnecterr(WSAGetLastError(), svr, &addr,
+				addrlen, statuscmd, useport);
 		}
 #endif
-		exit(1);
 	}
+	while(1) {
+		fd_set rset, wset, eset;
+		struct timeval tv;
+		FD_ZERO(&rset);
+		FD_SET(FD_SET_T fd, &rset);
+		FD_ZERO(&wset);
+		FD_SET(FD_SET_T fd, &wset);
+		FD_ZERO(&eset);
+		FD_SET(FD_SET_T fd, &eset);
+		tv.tv_sec = UNBOUND_CONTROL_CONNECT_TIMEOUT/1000;
+		tv.tv_usec= (UNBOUND_CONTROL_CONNECT_TIMEOUT%1000)*1000;
+		if(select(fd+1, &rset, &wset, &eset, &tv) == -1) {
+			fatal_exit("select: %s", sock_strerror(errno));
+		}
+		if(!FD_ISSET(fd, &rset) && !FD_ISSET(fd, &wset) &&
+			!FD_ISSET(fd, &eset)) {
+			fatal_exit("timeout: could not connect to server");
+		} else {
+			/* check nonblocking connect error */
+			int error = 0;
+			socklen_t len = (socklen_t)sizeof(error);
+			if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error,
+				&len) < 0) {
+#ifndef USE_WINSOCK
+				error = errno; /* on solaris errno is error */
+#else
+				error = WSAGetLastError();
+#endif
+			}
+			if(error != 0) {
+#ifndef USE_WINSOCK
+#ifdef EINPROGRESS
+				if(error == EINPROGRESS)
+					continue; /* try again later */
+#endif
+#ifdef EWOULDBLOCK
+				if(error == EWOULDBLOCK)
+					continue; /* try again later */
+#endif
+#else
+				if(error == WSAEINPROGRESS)
+					continue; /* try again later */
+				if(error == WSAEWOULDBLOCK)
+					continue; /* try again later */
+#endif
+				checkconnecterr(error, svr, &addr, addrlen,
+					statuscmd, useport);
+			}
+		}
+		break;
+	}
+	fd_set_block(fd);
 	return fd;
 }
 

From 70776609322d4629fd1418224887470498a670e0 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Fri, 11 Dec 2020 10:30:54 +0100
Subject: [PATCH 10/44] - Fix to squelch permission denied and other errors
 from remote host,   they are logged at higher verbosity but not on low
 verbosity.

---
 doc/Changelog   |  2 ++
 util/netevent.c | 21 +++++++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/doc/Changelog b/doc/Changelog
index af111d8a0..26e423f8e 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,5 +1,7 @@
 11 December 2020: Wouter
 	- Fix #371: unbound-control timeout when Unbound is not running.
+	- Fix to squelch permission denied and other errors from remote host,
+	  they are logged at higher verbosity but not on low verbosity.
 
 3 December 2020: Wouter
 	- make depend.
diff --git a/util/netevent.c b/util/netevent.c
index d3e268a01..7e604a9fa 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -583,6 +583,7 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
 static int udp_recv_needs_log(int err)
 {
 	switch(err) {
+	case EACCES: /* some hosts send ICMP 'Permission Denied' */
 #ifndef USE_WINSOCK
 	case ECONNREFUSED:
 #  ifdef ENETUNREACH
@@ -1609,6 +1610,26 @@ comm_point_tcp_handle_read(int fd, struct comm_point* c, int short_ok)
 			if(errno == ECONNRESET && verbosity < 2)
 				return 0; /* silence reset by peer */
 #endif
+#ifdef ENETUNREACH
+			if(errno == ENETUNREACH && verbosity < 2)
+				return 0; /* silence it */
+#endif
+#ifdef EHOSTDOWN
+			if(errno == EHOSTDOWN && verbosity < 2)
+				return 0; /* silence it */
+#endif
+#ifdef EHOSTUNREACH
+			if(errno == EHOSTUNREACH && verbosity < 2)
+				return 0; /* silence it */
+#endif
+#ifdef ENETDOWN
+			if(errno == ENETDOWN && verbosity < 2)
+				return 0; /* silence it */
+#endif
+#ifdef EACCES
+			if(errno == EACCES && verbosity < 2)
+				return 0; /* silence it */
+#endif
 #ifdef ENOTCONN
 			if(errno == ENOTCONN) {
 				log_err_addr("read (in tcp s) failed and this could be because TCP Fast Open is enabled [--disable-tfo-client --disable-tfo-server] but does not work", sock_strerror(errno),

From 15e1b16da0d7a75220c7365de3cf91d027437d00 Mon Sep 17 00:00:00 2001
From: Florian Obser <florian@narrans.de>
Date: Fri, 11 Dec 2020 14:00:20 +0100
Subject: [PATCH 11/44] Warning: arithmetic on a pointer to void is a GNU
 extension.

---
 util/netevent.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/util/netevent.c b/util/netevent.c
index 7e604a9fa..9eaa3c871 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -1935,7 +1935,7 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
 	log_assert(c->tcp_write_and_read || sldns_buffer_remaining(buffer) > 0);
 	log_assert(!c->tcp_write_and_read || c->tcp_write_byte_count < c->tcp_write_pkt_len + 2);
 	if(c->tcp_write_and_read) {
-		r = send(fd, (void*)c->tcp_write_pkt + c->tcp_write_byte_count - 2,
+		r = send(fd, (void*)(c->tcp_write_pkt + c->tcp_write_byte_count - 2),
 			c->tcp_write_pkt_len + 2 - c->tcp_write_byte_count, 0);
 	} else {
 		r = send(fd, (void*)sldns_buffer_current(buffer),

From f09b05877669ca41e5ec625bde14a2c468ed33ea Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Fri, 11 Dec 2020 14:04:01 +0100
Subject: [PATCH 12/44] Changelog note for #335 - Merge PR #335 from fobser:
 Sprinkle in some static to prevent   missing prototype warnings.

---
 doc/Changelog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/Changelog b/doc/Changelog
index 26e423f8e..7e38775ec 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -2,6 +2,8 @@
 	- Fix #371: unbound-control timeout when Unbound is not running.
 	- Fix to squelch permission denied and other errors from remote host,
 	  they are logged at higher verbosity but not on low verbosity.
+	- Merge PR #335 from fobser: Sprinkle in some static to prevent
+	  missing prototype warnings.
 
 3 December 2020: Wouter
 	- make depend.

From e1c678864d7d727d3bb729a577a21b235508c070 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Fri, 11 Dec 2020 14:07:42 +0100
Subject: [PATCH 13/44] Changelog note for #373 - Merge PR #373 from fobser:
 Warning: arithmetic on a pointer to void   is a GNU extension.

---
 doc/Changelog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/Changelog b/doc/Changelog
index 7e38775ec..dc4dee115 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -4,6 +4,8 @@
 	  they are logged at higher verbosity but not on low verbosity.
 	- Merge PR #335 from fobser: Sprinkle in some static to prevent
 	  missing prototype warnings.
+	- Merge PR #373 from fobser: Warning: arithmetic on a pointer to void
+	  is a GNU extension.
 
 3 December 2020: Wouter
 	- make depend.

From 811cf6db0c722fc8be7ebd7bf3b719ab387601f0 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Fri, 11 Dec 2020 14:34:39 +0100
Subject: [PATCH 14/44] - Fix missing prototypes in the code.

---
 dnstap/unbound-dnstap-socket.c |  6 +++++-
 doc/Changelog                  |  1 +
 dynlibmod/dynlibmod.c          | 14 +++++++-------
 libunbound/libworker.c         |  3 +++
 pythonmod/pythonmod_utils.c    |  1 +
 pythonmod/pythonmod_utils.h    |  3 ++-
 services/listen_dnsport.c      |  2 +-
 services/listen_dnsport.h      |  2 +-
 smallapp/worker_cb.c           |  3 +++
 testcode/fake_event.c          |  1 +
 testcode/testbound.c           | 16 ++++++++++++++--
 11 files changed, 39 insertions(+), 13 deletions(-)

diff --git a/dnstap/unbound-dnstap-socket.c b/dnstap/unbound-dnstap-socket.c
index 8c37654e8..8e28be4e8 100644
--- a/dnstap/unbound-dnstap-socket.c
+++ b/dnstap/unbound-dnstap-socket.c
@@ -727,7 +727,7 @@ static ssize_t tap_receive(struct tap_data* data, void* buf, size_t len)
 }
 
 /** delete the tap structure */
-void tap_data_free(struct tap_data* data)
+static void tap_data_free(struct tap_data* data)
 {
 	ub_event_del(data->ev);
 	ub_event_free(data->ev);
@@ -1355,6 +1355,10 @@ int main(int argc, char** argv)
 struct tube;
 struct query_info;
 #include "util/data/packed_rrset.h"
+#include "daemon/worker.h"
+#include "daemon/remote.h"
+#include "util/fptr_wlist.h"
+#include "libunbound/context.h"
 
 void worker_handle_control_cmd(struct tube* ATTR_UNUSED(tube),
 	uint8_t* ATTR_UNUSED(buffer), size_t ATTR_UNUSED(len),
diff --git a/doc/Changelog b/doc/Changelog
index dc4dee115..07a8e6ea4 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -6,6 +6,7 @@
 	  missing prototype warnings.
 	- Merge PR #373 from fobser: Warning: arithmetic on a pointer to void
 	  is a GNU extension.
+	- Fix missing prototypes in the code.
 
 3 December 2020: Wouter
 	- make depend.
diff --git a/dynlibmod/dynlibmod.c b/dynlibmod/dynlibmod.c
index 3bf9d1acb..3f148ebb6 100644
--- a/dynlibmod/dynlibmod.c
+++ b/dynlibmod/dynlibmod.c
@@ -5,16 +5,16 @@
  * module actions.
  */
 #include "config.h"
+#include "dynlibmod/dynlibmod.h"
 #include "util/module.h"
 #include "util/config_file.h"
-#include "dynlibmod/dynlibmod.h"
 
 #if HAVE_WINDOWS_H
 #include <windows.h>
 #define __DYNMOD HMODULE
 #define __DYNSYM FARPROC
 #define __LOADSYM GetProcAddress
-void log_dlerror() {
+static void log_dlerror() {
     DWORD dwLastError = GetLastError();
     LPSTR MessageBuffer;
     DWORD dwBufferLength;
@@ -37,11 +37,11 @@ void log_dlerror() {
 
 }
 
-HMODULE open_library(const char* fname) {
+static HMODULE open_library(const char* fname) {
     return LoadLibrary(fname);
 }
 
-void close_library(const char* fname, __DYNMOD handle) {
+static void close_library(const char* fname, __DYNMOD handle) {
 	(void)fname;
 	(void)handle;
 }
@@ -50,15 +50,15 @@ void close_library(const char* fname, __DYNMOD handle) {
 #define __DYNMOD void*
 #define __DYNSYM void*
 #define __LOADSYM dlsym
-void log_dlerror() {
+static void log_dlerror() {
     log_err("dynlibmod: %s", dlerror());
 }
 
-void* open_library(const char* fname) {
+static void* open_library(const char* fname) {
     return dlopen(fname, RTLD_LAZY | RTLD_GLOBAL);
 }
 
-void close_library(const char* fname, __DYNMOD handle) {
+static void close_library(const char* fname, __DYNMOD handle) {
 	if(!handle) return;
 	if(dlclose(handle) != 0) {
 		log_err("dlclose %s: %s", fname, strerror(errno));
diff --git a/libunbound/libworker.c b/libunbound/libworker.c
index 06cbb8869..03bbaf768 100644
--- a/libunbound/libworker.c
+++ b/libunbound/libworker.c
@@ -73,6 +73,9 @@
 #include "iterator/iter_hints.h"
 #include "sldns/sbuffer.h"
 #include "sldns/str2wire.h"
+#ifdef USE_DNSTAP
+#include "dnstap/dtstream.h"
+#endif
 
 #ifdef HAVE_TARGETCONDITIONALS_H
 #include <TargetConditionals.h>
diff --git a/pythonmod/pythonmod_utils.c b/pythonmod/pythonmod_utils.c
index 5d70f2b4b..9f7282540 100644
--- a/pythonmod/pythonmod_utils.c
+++ b/pythonmod/pythonmod_utils.c
@@ -39,6 +39,7 @@
  * conversions.
  */
 #include "config.h"
+#include "pythonmod/pythonmod_utils.h"
 #include "util/module.h"
 #include "util/netevent.h"
 #include "util/net_help.h"
diff --git a/pythonmod/pythonmod_utils.h b/pythonmod/pythonmod_utils.h
index 768eb46de..4ea86f9be 100644
--- a/pythonmod/pythonmod_utils.h
+++ b/pythonmod/pythonmod_utils.h
@@ -43,6 +43,7 @@
 
 #include "util/module.h"
 struct delegpt_addr;
+struct sldns_buffer;
 
 /**
  *  Store the reply_info and query_info pair in message cache (qstate->msg_cache)
@@ -77,7 +78,7 @@ void invalidateQueryInCache(struct module_qstate* qstate, struct query_info* qin
  * @param pkt: a sldns_buffer which contains sldns_packet data
  * @return 0 on failure, out of memory or parse error.
  */
-int createResponse(struct module_qstate* qstate, sldns_buffer* pkt);
+int createResponse(struct module_qstate* qstate, struct sldns_buffer* pkt);
 
 /**
  *  Convert reply->addr to string
diff --git a/services/listen_dnsport.c b/services/listen_dnsport.c
index 709c9e6ce..629d4de72 100644
--- a/services/listen_dnsport.c
+++ b/services/listen_dnsport.c
@@ -2793,7 +2793,7 @@ void http2_req_stream_clear(struct http2_stream* h2_stream)
 	}
 }
 
-nghttp2_session_callbacks* http2_req_callbacks_create()
+nghttp2_session_callbacks* http2_req_callbacks_create(void)
 {
 	nghttp2_session_callbacks *callbacks;
 	if(nghttp2_session_callbacks_new(&callbacks) == NGHTTP2_ERR_NOMEM) {
diff --git a/services/listen_dnsport.h b/services/listen_dnsport.h
index 9d6ea2c33..f438ff458 100644
--- a/services/listen_dnsport.h
+++ b/services/listen_dnsport.h
@@ -404,7 +404,7 @@ size_t http2_get_response_buffer_size(void);
  * Create nghttp2 callbacks to handle HTTP2 requests.
  * @return malloc'ed struct, NULL on failure
  */
-nghttp2_session_callbacks* http2_req_callbacks_create();
+nghttp2_session_callbacks* http2_req_callbacks_create(void);
 
 /** Free http2 stream buffers and decrease buffer counters */
 void http2_req_stream_clear(struct http2_stream* h2_stream);
diff --git a/smallapp/worker_cb.c b/smallapp/worker_cb.c
index 78d921a3c..cdf855dc3 100644
--- a/smallapp/worker_cb.c
+++ b/smallapp/worker_cb.c
@@ -46,6 +46,9 @@
 #include "util/fptr_wlist.h"
 #include "util/log.h"
 #include "services/mesh.h"
+#ifdef USE_DNSTAP
+#include "dnstap/dtstream.h"
+#endif
 
 void worker_handle_control_cmd(struct tube* ATTR_UNUSED(tube),
 	uint8_t* ATTR_UNUSED(buffer), size_t ATTR_UNUSED(len),
diff --git a/testcode/fake_event.c b/testcode/fake_event.c
index 591557c35..75a6b8db9 100644
--- a/testcode/fake_event.c
+++ b/testcode/fake_event.c
@@ -64,6 +64,7 @@
 #include "sldns/sbuffer.h"
 #include "sldns/wire2str.h"
 #include "sldns/str2wire.h"
+#include "daemon/remote.h"
 #include <signal.h>
 struct worker;
 struct daemon_remote;
diff --git a/testcode/testbound.c b/testcode/testbound.c
index 3f3e106b0..5e10779fc 100644
--- a/testcode/testbound.c
+++ b/testcode/testbound.c
@@ -42,16 +42,22 @@
 #ifdef HAVE_TIME_H
 #  include <time.h>
 #endif
+#include <ctype.h>
 #include "testcode/testpkts.h"
 #include "testcode/replay.h"
 #include "testcode/fake_event.h"
 #include "daemon/remote.h"
+#include "libunbound/worker.h"
 #include "util/config_file.h"
 #include "sldns/keyraw.h"
-#include <ctype.h>
+#ifdef UB_ON_WINDOWS
+#include "winrc/win_svc.h"
+#endif
 
 /** signal that this is a testbound compile */
 #define unbound_testbound 1
+/** renamed main routine */
+int daemon_main(int argc, char* argv[]);
 /** 
  * include the main program from the unbound daemon.
  * rename main to daemon_main to call it
@@ -333,7 +339,7 @@ setup_playback(const char* filename, int* pass_argc, char* pass_argv[])
 }
 
 /** remove config file at exit */
-void remove_configfile(void)
+static void remove_configfile(void)
 {
 	struct config_strlist* p;
 	for(p=cfgfiles; p; p=p->next)
@@ -551,22 +557,28 @@ void remote_get_opt_ssl(char* ATTR_UNUSED(str), void* ATTR_UNUSED(arg))
         log_assert(0);
 }
 
+#ifdef UB_ON_WINDOWS
 void wsvc_command_option(const char* ATTR_UNUSED(wopt), 
 	const char* ATTR_UNUSED(cfgfile), int ATTR_UNUSED(v), 
 	int ATTR_UNUSED(c))
 {
 	log_assert(0);
 }
+#endif
 
+#ifdef UB_ON_WINDOWS
 void wsvc_setup_worker(struct worker* ATTR_UNUSED(worker))
 {
 	/* do nothing */
 }
+#endif
 
+#ifdef UB_ON_WINDOWS
 void wsvc_desetup_worker(struct worker* ATTR_UNUSED(worker))
 {
 	/* do nothing */
 }
+#endif
 
 #ifdef UB_ON_WINDOWS
 void worker_win_stop_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),

From 42d764eeda2ae2fb545bbffda603865892fa5fab Mon Sep 17 00:00:00 2001
From: Frank Riley <fhriley@gmail.com>
Date: Sun, 13 Dec 2020 12:35:11 -0700
Subject: [PATCH 15/44] Add rpz_enable and rpz_disable commands to
 unbound-control.

---
 daemon/remote.c          | 55 ++++++++++++++++++++++++++++++++++++++++
 doc/unbound-control.8.in |  6 +++++
 services/rpz.c           | 18 +++++++++++--
 services/rpz.h           | 13 ++++++++++
 4 files changed, 90 insertions(+), 2 deletions(-)

diff --git a/daemon/remote.c b/daemon/remote.c
index 8324e1901..64057a57b 100644
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -2860,6 +2860,57 @@ do_ip_ratelimit_list(RES* ssl, struct worker* worker, char* arg)
 	slabhash_traverse(a.infra->client_ip_rates, 0, ip_rate_list, &a);
 }
 
+/** do the rpz_enable/disable command */
+static void
+do_rpz_enable_disable(RES* ssl, struct worker* worker, char* arg, int enable) {
+    size_t nmlen;
+    int nmlabs;
+    uint8_t *nm = NULL;
+    struct auth_zones *az = worker->env.auth_zones;
+    struct auth_zone *z = NULL;
+    if (!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
+        return;
+    if (az) {
+        lock_rw_rdlock(&az->lock);
+        z = auth_zone_find(az, nm, nmlen, LDNS_RR_CLASS_IN);
+        if (z) {
+            lock_rw_wrlock(&z->lock);
+        }
+        lock_rw_unlock(&az->lock);
+    }
+    free(nm);
+    if (!z) {
+        (void) ssl_printf(ssl, "error no auth-zone %s\n", arg);
+        return;
+    }
+    if (!z->rpz) {
+        (void) ssl_printf(ssl, "error auth-zone %s not RPZ\n", arg);
+        lock_rw_unlock(&z->lock);
+        return;
+    }
+    if (enable) {
+        rpz_enable(z->rpz);
+    } else {
+        rpz_disable(z->rpz);
+    }
+    lock_rw_unlock(&z->lock);
+    send_ok(ssl);
+}
+
+/** do the rpz_enable command */
+static void
+do_rpz_enable(RES* ssl, struct worker* worker, char* arg)
+{
+    do_rpz_enable_disable(ssl, worker, arg, 1);
+}
+
+/** do the rpz_disable command */
+static void
+do_rpz_disable(RES* ssl, struct worker* worker, char* arg)
+{
+    do_rpz_enable_disable(ssl, worker, arg, 0);
+}
+
 /** tell other processes to execute the command */
 static void
 distribute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd)
@@ -3060,6 +3111,10 @@ execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd,
 		do_flush_bogus(ssl, worker);
 	} else if(cmdcmp(p, "flush_negative", 14)) {
 		do_flush_negative(ssl, worker);
+    } else if(cmdcmp(p, "rpz_enable", 10)) {
+        do_rpz_enable(ssl, worker, skipwhite(p+10));
+    } else if(cmdcmp(p, "rpz_disable", 11)) {
+        do_rpz_disable(ssl, worker, skipwhite(p+11));
 	} else {
 		(void)ssl_printf(ssl, "error unknown command '%s'\n", p);
 	}
diff --git a/doc/unbound-control.8.in b/doc/unbound-control.8.in
index 97972ff27..20325abf2 100644
--- a/doc/unbound-control.8.in
+++ b/doc/unbound-control.8.in
@@ -305,6 +305,12 @@ Transfer the auth zone from master.  The auth zone probe sequence is started,
 where the masters are probed to see if they have an updated zone (with the SOA
 serial check).  And then the zone is transferred for a newer zone version.
 .TP
+.B rpz_enable \fIzone\fR
+Enable the RPZ zone if it had previously been disabled.
+.TP
+.B rpz_enable \fIzone\fR
+Disable the RPZ zone.
+.TP
 .B view_list_local_zones \fIview\fR
 \fIlist_local_zones\fR for given view.
 .TP
diff --git a/services/rpz.c b/services/rpz.c
index 13304652c..d7dd17f7e 100644
--- a/services/rpz.c
+++ b/services/rpz.c
@@ -963,8 +963,8 @@ rpz_apply_qname_trigger(struct auth_zones* az, struct module_env* env,
 	for(a = az->rpz_first; a; a = a->rpz_az_next) {
 		lock_rw_rdlock(&a->lock);
 		r = a->rpz;
-		if(!r->taglist || taglist_intersect(r->taglist, 
-			r->taglistlen, taglist, taglen)) {
+		if(!r->disabled && (!r->taglist || taglist_intersect(r->taglist,
+			r->taglistlen, taglist, taglen))) {
 			z = rpz_find_zone(r, qinfo->qname, qinfo->qname_len,
 				qinfo->qclass, 0, 0, 0);
 			if(z && r->action_override == RPZ_DISABLED_ACTION) {
@@ -1044,3 +1044,17 @@ rpz_apply_qname_trigger(struct auth_zones* az, struct module_env* env,
 
 	return ret;
 }
+
+void rpz_enable(struct rpz* r)
+{
+    if(!r)
+        return;
+    r->disabled = 0;
+}
+
+void rpz_disable(struct rpz* r)
+{
+    if(!r)
+        return;
+    r->disabled = 1;
+}
diff --git a/services/rpz.h b/services/rpz.h
index 77a2db55c..d5996a6cf 100644
--- a/services/rpz.h
+++ b/services/rpz.h
@@ -99,6 +99,7 @@ struct rpz {
 	int log;
 	char* log_name;
 	struct regional* region;
+	int disabled;
 };
 
 /**
@@ -198,4 +199,16 @@ void rpz_finish_config(struct rpz* r);
 enum respip_action
 rpz_action_to_respip_action(enum rpz_action a);
 
+/**
+ * Enable RPZ
+ * @param r: RPZ struct to enable
+ */
+void rpz_enable(struct rpz* r);
+
+/**
+ * Disable RPZ
+ * @param r: RPZ struct to disable
+ */
+void rpz_disable(struct rpz* r);
+
 #endif /* SERVICES_RPZ_H */

From 08968baec1122a58bb90d8f97ad948a75f8a5d69 Mon Sep 17 00:00:00 2001
From: George Thessalonikefs <george@nlnetlabs.nl>
Date: Wed, 16 Dec 2020 17:11:41 +0100
Subject: [PATCH 16/44] - Fix error cases when udp-connect is set and send()
 returns an error   (modified patch from Xin Li @delphij).

---
 doc/Changelog              |  4 ++++
 services/authzone.c        |  2 +-
 services/outside_network.c | 15 ++++-----------
 testcode/fake_event.c      |  2 +-
 util/netevent.c            | 29 +++++++++++++++++++----------
 util/netevent.h            |  3 ++-
 6 files changed, 31 insertions(+), 24 deletions(-)

diff --git a/doc/Changelog b/doc/Changelog
index 07a8e6ea4..3b831fea1 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+16 December 2020: George
+	- Fix error cases when udp-connect is set and send() returns an error
+	  (modified patch from Xin Li @delphij).
+
 11 December 2020: Wouter
 	- Fix #371: unbound-control timeout when Unbound is not running.
 	- Fix to squelch permission denied and other errors from remote host,
diff --git a/services/authzone.c b/services/authzone.c
index 15be5d60c..e59548fc3 100644
--- a/services/authzone.c
+++ b/services/authzone.c
@@ -6093,7 +6093,7 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 
 	/* send udp packet */
 	if(!comm_point_send_udp_msg(xfr->task_probe->cp, env->scratch_buffer,
-		(struct sockaddr*)&addr, addrlen)) {
+		(struct sockaddr*)&addr, addrlen, 0)) {
 		char zname[255+1], as[256];
 		dname_str(xfr->name, zname);
 		addr_to_str(&addr, addrlen, as, sizeof(as));
diff --git a/services/outside_network.c b/services/outside_network.c
index 0886907f7..d8f9874e6 100644
--- a/services/outside_network.c
+++ b/services/outside_network.c
@@ -1899,17 +1899,10 @@ randomize_and_send_udp(struct pending* pend, sldns_buffer* packet, int timeout)
 	log_assert(pend->pc && pend->pc->cp);
 
 	/* send it over the commlink */
-	if(outnet->udp_connect) {
-		if(!comm_point_send_udp_msg(pend->pc->cp, packet, NULL, 0)) {
-			portcomm_loweruse(outnet, pend->pc);
-			return 0;
-		}
-	} else {
-		if(!comm_point_send_udp_msg(pend->pc->cp, packet,
-			(struct sockaddr*)&pend->addr, pend->addrlen)) {
-			portcomm_loweruse(outnet, pend->pc);
-			return 0;
-		}
+	if(!comm_point_send_udp_msg(pend->pc->cp, packet,
+		(struct sockaddr*)&pend->addr, pend->addrlen, outnet->udp_connect)) {
+		portcomm_loweruse(outnet, pend->pc);
+		return 0;
 	}
 
 	/* system calls to set timeout after sending UDP to make roundtrip
diff --git a/testcode/fake_event.c b/testcode/fake_event.c
index 75a6b8db9..5164332c0 100644
--- a/testcode/fake_event.c
+++ b/testcode/fake_event.c
@@ -1766,7 +1766,7 @@ struct comm_point* outnet_comm_point_for_http(struct outside_network* outnet,
 }
 
 int comm_point_send_udp_msg(struct comm_point *c, sldns_buffer* packet,
-	struct sockaddr* addr, socklen_t addrlen) 
+	struct sockaddr* addr, socklen_t addrlen, int ATTR_UNUSED(is_connected))
 {
 	struct fake_commpoint* fc = (struct fake_commpoint*)c;
 	struct replay_runtime* runtime = fc->runtime;
diff --git a/util/netevent.c b/util/netevent.c
index 7c6da50be..88be007e7 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -333,7 +333,7 @@ int tcp_connect_errno_needs_log(struct sockaddr* addr, socklen_t addrlen)
 /* send a UDP reply */
 int
 comm_point_send_udp_msg(struct comm_point *c, sldns_buffer* packet,
-	struct sockaddr* addr, socklen_t addrlen) 
+	struct sockaddr* addr, socklen_t addrlen, int is_connected)
 {
 	ssize_t sent;
 	log_assert(c->fd != -1);
@@ -341,8 +341,8 @@ comm_point_send_udp_msg(struct comm_point *c, sldns_buffer* packet,
 	if(sldns_buffer_remaining(packet) == 0)
 		log_err("error: send empty UDP packet");
 #endif
-	if(addr) {
-		log_assert(addr && addrlen > 0);
+	log_assert(addr && addrlen > 0);
+	if(!is_connected) {
 		sent = sendto(c->fd, (void*)sldns_buffer_begin(packet),
 			sldns_buffer_remaining(packet), 0,
 			addr, addrlen);
@@ -367,9 +367,14 @@ comm_point_send_udp_msg(struct comm_point *c, sldns_buffer* packet,
 #endif
 			int e;
 			fd_set_block(c->fd);
-			sent = sendto(c->fd, (void*)sldns_buffer_begin(packet), 
-				sldns_buffer_remaining(packet), 0,
-				addr, addrlen);
+			if (!is_connected) {
+				sent = sendto(c->fd, (void*)sldns_buffer_begin(packet),
+					sldns_buffer_remaining(packet), 0,
+					addr, addrlen);
+			} else {
+				sent = send(c->fd, (void*)sldns_buffer_begin(packet),
+					sldns_buffer_remaining(packet), 0);
+			}
 			e = errno;
 			fd_set_nonblock(c->fd);
 			errno = e;
@@ -378,8 +383,12 @@ comm_point_send_udp_msg(struct comm_point *c, sldns_buffer* packet,
 	if(sent == -1) {
 		if(!udp_send_errno_needs_log(addr, addrlen))
 			return 0;
-		verbose(VERB_OPS, "sendto failed: %s", sock_strerror(errno));
-		log_addr(VERB_OPS, "remote address is", 
+		if (!is_connected) {
+			verbose(VERB_OPS, "sendto failed: %s", sock_strerror(errno));
+		} else {
+			verbose(VERB_OPS, "send failed: %s", sock_strerror(errno));
+		}
+		log_addr(VERB_OPS, "remote address is",
 			(struct sockaddr_storage*)addr, addrlen);
 		return 0;
 	} else if((size_t)sent != sldns_buffer_remaining(packet)) {
@@ -764,7 +773,7 @@ comm_point_udp_callback(int fd, short event, void* arg)
 			buffer = rep.c->buffer;
 #endif
 			(void)comm_point_send_udp_msg(rep.c, buffer,
-				(struct sockaddr*)&rep.addr, rep.addrlen);
+				(struct sockaddr*)&rep.addr, rep.addrlen, 0);
 		}
 		if(!rep.c || rep.c->fd != fd) /* commpoint closed to -1 or reused for
 		another UDP port. Note rep.c cannot be reused with TCP fd. */
@@ -3944,7 +3953,7 @@ comm_point_send_reply(struct comm_reply *repinfo)
 			repinfo->addrlen, repinfo);
 		else
 			comm_point_send_udp_msg(repinfo->c, buffer,
-			(struct sockaddr*)&repinfo->addr, repinfo->addrlen);
+			(struct sockaddr*)&repinfo->addr, repinfo->addrlen, 0);
 #ifdef USE_DNSTAP
 		if(repinfo->c->dtenv != NULL &&
 		   repinfo->c->dtenv->log_client_response_messages)
diff --git a/util/netevent.h b/util/netevent.h
index 266a74ff3..810190683 100644
--- a/util/netevent.h
+++ b/util/netevent.h
@@ -633,10 +633,11 @@ void comm_point_drop_reply(struct comm_reply* repinfo);
  * @param addr: where to send it to.   If NULL, send is performed,
  * 	for connected sockets, to the connected address.
  * @param addrlen: length of addr.
+ * @param is_connected: if the UDP socket is connect()ed.
  * @return: false on a failure.
  */
 int comm_point_send_udp_msg(struct comm_point* c, struct sldns_buffer* packet,
-	struct sockaddr* addr, socklen_t addrlen);
+	struct sockaddr* addr, socklen_t addrlen,int is_connected);
 
 /**
  * Stop listening for input on the commpoint. No callbacks will happen.

From e3abd772f7b247c9b97e8656f8cf765eaca7c431 Mon Sep 17 00:00:00 2001
From: Frank Riley <fhriley@gmail.com>
Date: Fri, 1 Jan 2021 15:29:32 -0700
Subject: [PATCH 17/44] Add start_time to reply callbacks so modules can
 compute the response time.

---
 daemon/worker.c                 | 21 ++++++++++++++-------
 dynlibmod/dynlibmod.c           |  6 +++---
 dynlibmod/dynlibmod.h           |  4 ++--
 dynlibmod/examples/helloworld.c |  8 ++++----
 pythonmod/interface.i           | 24 +++++++++++++++++++++---
 pythonmod/pythonmod.h           |  4 ++--
 services/authzone.c             |  4 ++--
 services/localzone.c            |  4 ++--
 services/mesh.c                 | 32 +++++++++++++++++++-------------
 util/data/msgreply.c            | 25 +++++++++++++++----------
 util/data/msgreply.h            | 12 ++++++++----
 util/module.h                   |  4 ++--
 12 files changed, 94 insertions(+), 54 deletions(-)

diff --git a/daemon/worker.c b/daemon/worker.c
index 76c4bb5b1..edf96988a 100644
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -513,7 +513,8 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 			edns->ext_rcode = 0;
 			edns->bits &= EDNS_DO;
 			if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL,
-				msg->rep, LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad))
+				msg->rep, LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad,
+				*worker->env.now_tv))
 					return 0;
 			error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
 				&msg->qinfo, id, flags, edns);
@@ -544,7 +545,8 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 	edns->ext_rcode = 0;
 	edns->bits &= EDNS_DO;
 	if(!inplace_cb_reply_cache_call(&worker->env, qinfo, NULL, msg->rep,
-		(int)(flags&LDNS_RCODE_MASK), edns, repinfo, worker->scratchpad))
+		(int)(flags&LDNS_RCODE_MASK), edns, repinfo, worker->scratchpad,
+        *worker->env.now_tv))
 			return 0;
 	msg->rep->flags |= BIT_QR|BIT_RA;
 	if(!apply_edns_options(edns, &edns_bak, worker->env.cfg,
@@ -553,7 +555,8 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 		repinfo->c->buffer, 0, 1, worker->scratchpad,
 		udpsize, edns, (int)(edns->bits & EDNS_DO), secure)) {
 		if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, NULL,
-			LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad))
+			LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad,
+			*worker->env.now_tv))
 				edns->opt_list = NULL;
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
 			&msg->qinfo, id, flags, edns);
@@ -684,7 +687,8 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 		edns->ext_rcode = 0;
 		edns->bits &= EDNS_DO;
 		if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, rep,
-			LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad))
+			LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad,
+           *worker->env.now_tv))
 			goto bail_out;
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL,
 			qinfo, id, flags, edns);
@@ -718,7 +722,8 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	edns->ext_rcode = 0;
 	edns->bits &= EDNS_DO;
 	if(!inplace_cb_reply_cache_call(&worker->env, qinfo, NULL, rep,
-		(int)(flags&LDNS_RCODE_MASK), edns, repinfo, worker->scratchpad))
+		(int)(flags&LDNS_RCODE_MASK), edns, repinfo, worker->scratchpad,
+		*worker->env.now_tv))
 		goto bail_out;
 	*alias_rrset = NULL; /* avoid confusion if caller set it to non-NULL */
 	if((worker->daemon->use_response_ip || worker->daemon->use_rpz) &&
@@ -754,7 +759,8 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 		repinfo->c->buffer, timenow, 1, worker->scratchpad,
 		udpsize, edns, (int)(edns->bits & EDNS_DO), *is_secure_answer)) {
 		if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, NULL,
-			LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad))
+			LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad,
+           *worker->env.now_tv))
 				edns->opt_list = NULL;
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
 			qinfo, id, flags, edns);
@@ -842,7 +848,8 @@ chaos_replystr(sldns_buffer* pkt, char** str, int num, struct edns_data* edns,
 	edns->udp_size = EDNS_ADVERTISED_SIZE;
 	edns->bits &= EDNS_DO;
 	if(!inplace_cb_reply_local_call(&worker->env, NULL, NULL, NULL,
-		LDNS_RCODE_NOERROR, edns, repinfo, worker->scratchpad))
+		LDNS_RCODE_NOERROR, edns, repinfo, worker->scratchpad,
+        *worker->env.now_tv))
 			edns->opt_list = NULL;
 	if(sldns_buffer_capacity(pkt) >=
 		sldns_buffer_limit(pkt)+calc_edns_field_size(edns))
diff --git a/dynlibmod/dynlibmod.c b/dynlibmod/dynlibmod.c
index 3f148ebb6..e842c9d8a 100644
--- a/dynlibmod/dynlibmod.c
+++ b/dynlibmod/dynlibmod.c
@@ -212,10 +212,10 @@ size_t dynlibmod_get_mem(struct module_env* env, int id) {
 int dynlib_inplace_cb_reply_generic(struct query_info* qinfo,
     struct module_qstate* qstate, struct reply_info* rep, int rcode,
     struct edns_data* edns, struct edns_option** opt_list_out,
-    struct comm_reply* repinfo, struct regional* region, int id,
-    void* callback) {
+    struct comm_reply* repinfo, struct regional* region,
+    struct timeval start_time, int id, void* callback) {
     struct cb_pair* cb_pair = (struct cb_pair*) callback;
-    return ((inplace_cb_reply_func_type*) cb_pair->cb)(qinfo, qstate, rep, rcode, edns, opt_list_out, repinfo, region, id, cb_pair->cb_arg);
+    return ((inplace_cb_reply_func_type*) cb_pair->cb)(qinfo, qstate, rep, rcode, edns, opt_list_out, repinfo, region, start_time, id, cb_pair->cb_arg);
 }
 
 int dynlib_inplace_cb_query_generic(struct query_info* qinfo, uint16_t flags,
diff --git a/dynlibmod/dynlibmod.h b/dynlibmod/dynlibmod.h
index c34cf0e88..f35dafa1a 100644
--- a/dynlibmod/dynlibmod.h
+++ b/dynlibmod/dynlibmod.h
@@ -70,8 +70,8 @@ size_t dynlibmod_get_mem(struct module_env* env, int id);
 int dynlib_inplace_cb_reply_generic(struct query_info* qinfo,
     struct module_qstate* qstate, struct reply_info* rep, int rcode,
     struct edns_data* edns, struct edns_option** opt_list_out,
-    struct comm_reply* repinfo, struct regional* region, int id,
-    void* callback);
+    struct comm_reply* repinfo, struct regional* region,
+	struct timeval start_time, int id, void* callback);
 
 int dynlib_inplace_cb_query_generic(struct query_info* qinfo, uint16_t flags,
     struct module_qstate* qstate, struct sockaddr_storage* addr,
diff --git a/dynlibmod/examples/helloworld.c b/dynlibmod/examples/helloworld.c
index acb6b5d9b..5ea9c51be 100644
--- a/dynlibmod/examples/helloworld.c
+++ b/dynlibmod/examples/helloworld.c
@@ -30,8 +30,8 @@
 int reply_callback(struct query_info* qinfo,
     struct module_qstate* qstate, struct reply_info* rep, int rcode,
     struct edns_data* edns, struct edns_option** opt_list_out,
-    struct comm_reply* repinfo, struct regional* region, int id,
-    void* callback);
+    struct comm_reply* repinfo, struct regional* region,
+    struct timeval start_time, int id, void* callback);
 
 /* Init is called when the module is first loaded. It should be used to set up
  * the environment for this module and do any other initialisation required. */
@@ -116,8 +116,8 @@ EXPORT size_t get_mem(struct module_env* env, int id) {
 int reply_callback(struct query_info* qinfo,
     struct module_qstate* qstate, struct reply_info* rep, int rcode,
     struct edns_data* edns, struct edns_option** opt_list_out,
-    struct comm_reply* repinfo, struct regional* region, int id,
-    void* callback) {
+    struct comm_reply* repinfo, struct regional* region,
+    struct timeval start_time, int id, void* callback) {
     log_info("dynlib: hello world from callback");
     struct dynlibmod_env* env = qstate->env->modinfo[id];
     if (env->dyn_env != NULL) {
diff --git a/pythonmod/interface.i b/pythonmod/interface.i
index cbee4f714..8f44e52b6 100644
--- a/pythonmod/interface.i
+++ b/pythonmod/interface.i
@@ -20,6 +20,7 @@
  * called to perform operations on queries.
  */
    #include <sys/types.h>
+   #include <time.h>
    #ifdef HAVE_SYS_SOCKET_H
    #include <sys/socket.h>
    #endif
@@ -696,6 +697,8 @@ struct edns_data {
 /* ************************************************************************************ *
    Structure module_env
  * ************************************************************************************ */
+%rename(_now) module_env::now;
+%rename(_now_tv) module_env::now_tv;
 struct module_env {
     struct config_file* cfg;
     struct slabhash* msg_cache;
@@ -739,6 +742,19 @@ struct module_env {
     size_t edns_known_options_num;
 };
 
+%inline %{
+    PyObject* _module_env_now_get(struct module_env* env) {
+        double ts = env->now_tv->tv_sec + env->now_tv->tv_usec / 1e6;
+        return PyFloat_FromDouble(ts);
+    }
+%}
+%extend module_env {
+    %pythoncode %{
+        def _now_get(self): return _module_env_now_get(self)
+        now = property(_now_get)
+    %}
+}
+
 /* ************************************************************************************ *
    Structure module_qstate
  * ************************************************************************************ */
@@ -1525,13 +1541,14 @@ int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len,
     int python_inplace_cb_reply_generic(struct query_info* qinfo,
         struct module_qstate* qstate, struct reply_info* rep, int rcode,
         struct edns_data* edns, struct edns_option** opt_list_out,
-        struct comm_reply* repinfo, struct regional* region, int id,
-        void* python_callback)
+        struct comm_reply* repinfo, struct regional* region,
+        struct timeval start_time, int id, void* python_callback)
     {
         PyObject *func, *py_edns, *py_qstate, *py_opt_list_out, *py_qinfo;
         PyObject *py_rep, *py_repinfo, *py_region;
         PyObject *py_args, *py_kwargs, *result;
         int res = 0;
+        double py_start_time = start_time.tv_sec + start_time.tv_usec / 1e6;
 
         PyGILState_STATE gstate = PyGILState_Ensure();
         func = (PyObject *) python_callback;
@@ -1546,7 +1563,8 @@ int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len,
         py_region = SWIG_NewPointerObj((void*) region, SWIGTYPE_p_regional, 0);
         py_args = Py_BuildValue("(OOOiOOO)", py_qinfo, py_qstate, py_rep,
             rcode, py_edns, py_opt_list_out, py_region);
-        py_kwargs = Py_BuildValue("{s:O}", "repinfo", py_repinfo);
+        py_kwargs = Py_BuildValue("{s:O,s:d}", "repinfo", py_repinfo, "start_time",
+                                  py_start_time);
         result = PyObject_Call(func, py_args, py_kwargs);
         Py_XDECREF(py_edns);
         Py_XDECREF(py_qstate);
diff --git a/pythonmod/pythonmod.h b/pythonmod/pythonmod.h
index ae8af27eb..222ebd71e 100644
--- a/pythonmod/pythonmod.h
+++ b/pythonmod/pythonmod.h
@@ -72,8 +72,8 @@ size_t pythonmod_get_mem(struct module_env* env, int id);
 int python_inplace_cb_reply_generic(struct query_info* qinfo,
 	struct module_qstate* qstate, struct reply_info* rep, int rcode,
 	struct edns_data* edns, struct edns_option** opt_list_out,
-	struct comm_reply* repinfo, struct regional* region, int id,
-	void* python_callback);
+	struct comm_reply* repinfo, struct regional* region,
+    struct timeval start_time, int id, void* python_callback);
 
 /** Declared here for fptr_wlist access. The definition is in interface.i. */
 int python_inplace_cb_query_generic(
diff --git a/services/authzone.c b/services/authzone.c
index e59548fc3..0f6d691a2 100644
--- a/services/authzone.c
+++ b/services/authzone.c
@@ -3286,7 +3286,7 @@ auth_answer_encode(struct query_info* qinfo, struct module_env* env,
 	edns->bits &= EDNS_DO;
 
 	if(!inplace_cb_reply_local_call(env, qinfo, NULL, msg->rep,
-		(int)FLAGS_GET_RCODE(msg->rep->flags), edns, repinfo, temp)
+		(int)FLAGS_GET_RCODE(msg->rep->flags), edns, repinfo, temp, *env->now_tv)
 		|| !reply_info_answer_encode(qinfo, msg->rep,
 		*(uint16_t*)sldns_buffer_begin(buf),
 		sldns_buffer_read_u16_at(buf, 2),
@@ -3310,7 +3310,7 @@ auth_error_encode(struct query_info* qinfo, struct module_env* env,
 	edns->bits &= EDNS_DO;
 
 	if(!inplace_cb_reply_local_call(env, qinfo, NULL, NULL,
-		rcode, edns, repinfo, temp))
+		rcode, edns, repinfo, temp, *env->now_tv))
 		edns->opt_list = NULL;
 	error_encode(buf, rcode|BIT_AA, qinfo,
 		*(uint16_t*)sldns_buffer_begin(buf),
diff --git a/services/localzone.c b/services/localzone.c
index cad460663..308150a00 100644
--- a/services/localzone.c
+++ b/services/localzone.c
@@ -1215,7 +1215,7 @@ local_encode(struct query_info* qinfo, struct module_env* env,
 	edns->ext_rcode = 0;
 	edns->bits &= EDNS_DO;
 	if(!inplace_cb_reply_local_call(env, qinfo, NULL, &rep, rcode, edns,
-		repinfo, temp) || !reply_info_answer_encode(qinfo, &rep,
+		repinfo, temp, *env->now_tv) || !reply_info_answer_encode(qinfo, &rep,
 		*(uint16_t*)sldns_buffer_begin(buf), sldns_buffer_read_u16_at(buf, 2),
 		buf, 0, 0, temp, udpsize, edns, (int)(edns->bits&EDNS_DO), 0)) {
 		error_encode(buf, (LDNS_RCODE_SERVFAIL|BIT_AA), qinfo,
@@ -1237,7 +1237,7 @@ local_error_encode(struct query_info* qinfo, struct module_env* env,
 	edns->bits &= EDNS_DO;
 
 	if(!inplace_cb_reply_local_call(env, qinfo, NULL, NULL,
-		rcode, edns, repinfo, temp))
+		rcode, edns, repinfo, temp, *env->now_tv))
 		edns->opt_list = NULL;
 	error_encode(buf, r, qinfo, *(uint16_t*)sldns_buffer_begin(buf),
 		sldns_buffer_read_u16_at(buf, 2), edns);
diff --git a/services/mesh.c b/services/mesh.c
index cd9050936..de481c0d5 100644
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -498,7 +498,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 		if(!s) {
 			log_err("mesh_state_create: out of memory; SERVFAIL");
 			if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL, NULL,
-				LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch))
+				LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, *s->s.env->now_tv))
 					edns->opt_list = NULL;
 			error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
 				qinfo, qid, qflags, edns);
@@ -514,7 +514,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 			if(!s->s.edns_opts_front_in) {
 				log_err("mesh_state_create: out of memory; SERVFAIL");
 				if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL,
-					NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch))
+					NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, *s->s.env->now_tv))
 						edns->opt_list = NULL;
 				error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
 					qinfo, qid, qflags, edns);
@@ -587,7 +587,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 
 servfail_mem:
 	if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, &s->s,
-		NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch))
+		NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, *s->s.env->now_tv))
 			edns->opt_list = NULL;
 	error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
 		qinfo, qid, qflags, edns);
@@ -1115,7 +1115,7 @@ int mesh_state_attachment(struct mesh_state* super, struct mesh_state* sub)
  */
 static void
 mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
-	struct mesh_cb* r)
+	struct mesh_cb* r, struct timeval start_time)
 {
 	int secure;
 	char* reason = NULL;
@@ -1136,11 +1136,11 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
 	if(rcode) {
 		if(rcode == LDNS_RCODE_SERVFAIL) {
 			if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
-				rep, rcode, &r->edns, NULL, m->s.region))
+				rep, rcode, &r->edns, NULL, m->s.region, start_time))
 					r->edns.opt_list = NULL;
 		} else {
 			if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode,
-				&r->edns, NULL, m->s.region))
+				&r->edns, NULL, m->s.region, start_time))
 					r->edns.opt_list = NULL;
 		}
 		fptr_ok(fptr_whitelist_mesh_cb(r->cb));
@@ -1155,7 +1155,7 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
 		r->edns.bits &= EDNS_DO;
 
 		if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep,
-			LDNS_RCODE_NOERROR, &r->edns, NULL, m->s.region) ||
+			LDNS_RCODE_NOERROR, &r->edns, NULL, m->s.region, start_time) ||
 			!reply_info_answer_encode(&m->s.qinfo, rep, r->qid, 
 			r->qflags, r->buf, 0, 1, 
 			m->s.env->scratch, udp_size, &r->edns, 
@@ -1256,11 +1256,11 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 		m->s.qinfo.local_alias = r->local_alias;
 		if(rcode == LDNS_RCODE_SERVFAIL) {
 			if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
-				rep, rcode, &r->edns, &r->query_reply, m->s.region))
+				rep, rcode, &r->edns, &r->query_reply, m->s.region, r->start_time))
 					r->edns.opt_list = NULL;
 		} else { 
 			if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode,
-				&r->edns, &r->query_reply, m->s.region))
+				&r->edns, &r->query_reply, m->s.region, r->start_time))
 					r->edns.opt_list = NULL;
 		}
 		error_encode(r_buffer, rcode, &m->s.qinfo, r->qid,
@@ -1277,7 +1277,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 		m->s.qinfo.qname = r->qname;
 		m->s.qinfo.local_alias = r->local_alias;
 		if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep,
-			LDNS_RCODE_NOERROR, &r->edns, &r->query_reply, m->s.region) ||
+			LDNS_RCODE_NOERROR, &r->edns, &r->query_reply, m->s.region, r->start_time) ||
 			!apply_edns_options(&r->edns, &edns_bak,
 				m->s.env->cfg, r->query_reply.c,
 				m->s.region) ||
@@ -1287,7 +1287,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 			secure)) 
 		{
 			if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
-			rep, LDNS_RCODE_SERVFAIL, &r->edns, &r->query_reply, m->s.region))
+			rep, LDNS_RCODE_SERVFAIL, &r->edns, &r->query_reply, m->s.region, r->start_time))
 				r->edns.opt_list = NULL;
 			error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
 				&m->s.qinfo, r->qid, r->qflags, &r->edns);
@@ -1330,6 +1330,7 @@ void mesh_query_done(struct mesh_state* mstate)
 	struct mesh_cb* c;
 	struct reply_info* rep = (mstate->s.return_msg?
 		mstate->s.return_msg->rep:NULL);
+	struct timeval tv = {0, 0};
 	/* No need for the serve expired timer anymore; we are going to reply. */
 	if(mstate->s.serve_expired_data) {
 		comm_timer_delete(mstate->s.serve_expired_data->timer);
@@ -1349,6 +1350,8 @@ void mesh_query_done(struct mesh_state* mstate)
 		}
 	}
 	for(r = mstate->reply_list; r; r = r->next) {
+	    tv = r->start_time;
+
 		/* if a response-ip address block has been stored the
 		 *  information should be logged for each client. */
 		if(mstate->s.respip_action_info &&
@@ -1421,7 +1424,7 @@ void mesh_query_done(struct mesh_state* mstate)
 		if(!mstate->reply_list && !mstate->cb_list &&
 			mstate->super_set.count == 0)
 			mstate->s.env->mesh->num_detached_states++;
-		mesh_do_callback(mstate, mstate->s.return_rcode, rep, c);
+		mesh_do_callback(mstate, mstate->s.return_rcode, rep, c, tv);
 	}
 }
 
@@ -1917,6 +1920,7 @@ mesh_serve_expired_callback(void* arg)
 	struct respip_action_info actinfo;
 	struct query_info* lookup_qinfo = &qstate->qinfo;
 	struct query_info qinfo_tmp;
+	struct timeval tv = {0, 0};
 	int must_validate = (!(qstate->query_flags&BIT_CD)
 		|| qstate->env->cfg->ignore_cd) && qstate->env->need_to_validate;
 	if(!qstate->serve_expired_data) return;
@@ -1988,6 +1992,8 @@ mesh_serve_expired_callback(void* arg)
 		log_dns_msg("Serve expired lookup", &qstate->qinfo, msg->rep);
 
 	for(r = mstate->reply_list; r; r = r->next) {
+	    tv = r->start_time;
+
 		/* If address info is returned, it means the action should be an
 		* 'inform' variant and the information should be logged. */
 		if(actinfo.addrinfo) {
@@ -2042,6 +2048,6 @@ mesh_serve_expired_callback(void* arg)
 		if(!mstate->reply_list && !mstate->cb_list &&
 			mstate->super_set.count == 0)
 			qstate->env->mesh->num_detached_states++;
-		mesh_do_callback(mstate, LDNS_RCODE_NOERROR, msg->rep, c);
+		mesh_do_callback(mstate, LDNS_RCODE_NOERROR, msg->rep, c, tv);
 	}
 }
diff --git a/util/data/msgreply.c b/util/data/msgreply.c
index 927bf09a2..3f7eb5fc9 100644
--- a/util/data/msgreply.c
+++ b/util/data/msgreply.c
@@ -1035,7 +1035,8 @@ static int inplace_cb_reply_call_generic(
     struct inplace_cb* callback_list, enum inplace_cb_list_type type,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
-	struct comm_reply* repinfo, struct regional* region)
+	struct comm_reply* repinfo, struct regional* region,
+    struct timeval start_time)
 {
 	struct inplace_cb* cb;
 	struct edns_option* opt_list_out = NULL;
@@ -1048,7 +1049,7 @@ static int inplace_cb_reply_call_generic(
 		fptr_ok(fptr_whitelist_inplace_cb_reply_generic(
 			(inplace_cb_reply_func_type*)cb->cb, type));
 		(void)(*(inplace_cb_reply_func_type*)cb->cb)(qinfo, qstate, rep,
-			rcode, edns, &opt_list_out, repinfo, region, cb->id, cb->cb_arg);
+			rcode, edns, &opt_list_out, repinfo, region, start_time, cb->id, cb->cb_arg);
 	}
 	edns->opt_list = opt_list_out;
 	return 1;
@@ -1056,37 +1057,41 @@ static int inplace_cb_reply_call_generic(
 
 int inplace_cb_reply_call(struct module_env* env, struct query_info* qinfo,
 	struct module_qstate* qstate, struct reply_info* rep, int rcode,
-	struct edns_data* edns, struct comm_reply* repinfo, struct regional* region)
+	struct edns_data* edns, struct comm_reply* repinfo, struct regional* region,
+    struct timeval start_time)
 {
 	return inplace_cb_reply_call_generic(
 		env->inplace_cb_lists[inplace_cb_reply], inplace_cb_reply, qinfo,
-		qstate, rep, rcode, edns, repinfo, region);
+		qstate, rep, rcode, edns, repinfo, region, start_time);
 }
 
 int inplace_cb_reply_cache_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
-	struct comm_reply* repinfo, struct regional* region)
+	struct comm_reply* repinfo, struct regional* region,
+    struct timeval start_time)
 {
 	return inplace_cb_reply_call_generic(
 		env->inplace_cb_lists[inplace_cb_reply_cache], inplace_cb_reply_cache,
-		qinfo, qstate, rep, rcode, edns, repinfo, region);
+		qinfo, qstate, rep, rcode, edns, repinfo, region, start_time);
 }
 
 int inplace_cb_reply_local_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
-	struct comm_reply* repinfo, struct regional* region)
+	struct comm_reply* repinfo, struct regional* region,
+    struct timeval start_time)
 {
 	return inplace_cb_reply_call_generic(
 		env->inplace_cb_lists[inplace_cb_reply_local], inplace_cb_reply_local,
-		qinfo, qstate, rep, rcode, edns, repinfo, region);
+		qinfo, qstate, rep, rcode, edns, repinfo, region, start_time);
 }
 
 int inplace_cb_reply_servfail_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
-	struct comm_reply* repinfo, struct regional* region)
+	struct comm_reply* repinfo, struct regional* region,
+    struct timeval start_time)
 {
 	/* We are going to servfail. Remove any potential edns options. */
 	if(qstate)
@@ -1094,7 +1099,7 @@ int inplace_cb_reply_servfail_call(struct module_env* env,
 	return inplace_cb_reply_call_generic(
 		env->inplace_cb_lists[inplace_cb_reply_servfail],
 		inplace_cb_reply_servfail, qinfo, qstate, rep, rcode, edns, repinfo,
-		region);
+		region, start_time);
 }
 
 int inplace_cb_query_call(struct module_env* env, struct query_info* qinfo,
diff --git a/util/data/msgreply.h b/util/data/msgreply.h
index 385780268..b7706b023 100644
--- a/util/data/msgreply.h
+++ b/util/data/msgreply.h
@@ -558,7 +558,8 @@ struct edns_option* edns_opt_list_find(struct edns_option* list, uint16_t code);
  */
 int inplace_cb_reply_call(struct module_env* env, struct query_info* qinfo,
 	struct module_qstate* qstate, struct reply_info* rep, int rcode,
-	struct edns_data* edns, struct comm_reply* repinfo, struct regional* region);
+	struct edns_data* edns, struct comm_reply* repinfo, struct regional* region,
+    struct timeval start_time);
 
 /**
  * Call the registered functions in the inplace_cb_reply_cache linked list.
@@ -576,7 +577,8 @@ int inplace_cb_reply_call(struct module_env* env, struct query_info* qinfo,
 int inplace_cb_reply_cache_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
-	struct comm_reply* repinfo, struct regional* region);
+	struct comm_reply* repinfo, struct regional* region,
+    struct timeval start_time);
 
 /**
  * Call the registered functions in the inplace_cb_reply_local linked list.
@@ -594,7 +596,8 @@ int inplace_cb_reply_cache_call(struct module_env* env,
 int inplace_cb_reply_local_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
-	struct comm_reply* repinfo, struct regional* region);
+	struct comm_reply* repinfo, struct regional* region,
+    struct timeval start_time);
 
 /**
  * Call the registered functions in the inplace_cb_reply linked list.
@@ -613,7 +616,8 @@ int inplace_cb_reply_local_call(struct module_env* env,
 int inplace_cb_reply_servfail_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
-	struct comm_reply* repinfo, struct regional* region);
+	struct comm_reply* repinfo, struct regional* region,
+    struct timeval start_time);
 
 /**
  * Call the registered functions in the inplace_cb_query linked list.
diff --git a/util/module.h b/util/module.h
index 7b833f8ad..d29b6f318 100644
--- a/util/module.h
+++ b/util/module.h
@@ -257,8 +257,8 @@ struct inplace_cb {
 typedef int inplace_cb_reply_func_type(struct query_info* qinfo,
 	struct module_qstate* qstate, struct reply_info* rep, int rcode,
 	struct edns_data* edns, struct edns_option** opt_list_out,
-	struct comm_reply* repinfo, struct regional* region, int id,
-	void* callback);
+	struct comm_reply* repinfo, struct regional* region,
+    struct timeval start_time, int id, void* callback);
 
 /**
  * Inplace callback function called before sending the query to a nameserver.

From 4d51c6b86e84e0786d9cd5134fce536e5cf1980f Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Mon, 4 Jan 2021 14:05:50 +0100
Subject: [PATCH 18/44] - For #376: Fix that comm point event is not double
 removed or double   added to event map.

---
 doc/Changelog   |  4 ++++
 util/netevent.c | 34 ++++++++++++++++++++++++++++------
 util/netevent.h |  2 ++
 3 files changed, 34 insertions(+), 6 deletions(-)

diff --git a/doc/Changelog b/doc/Changelog
index 3b831fea1..be7d1756e 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+4 January 2021: Wouter
+	- For #376: Fix that comm point event is not double removed or double
+	  added to event map.
+
 16 December 2020: George
 	- Fix error cases when udp-connect is set and send() returns an error
 	  (modified patch from Xin Li @delphij).
diff --git a/util/netevent.c b/util/netevent.c
index 88be007e7..5c7550805 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -3230,6 +3230,7 @@ comm_point_create_udp(struct comm_base *base, int fd, sldns_buffer* buffer,
 		comm_point_delete(c);
 		return NULL;
 	}
+	c->event_added = 1;
 	return c;
 }
 
@@ -3289,6 +3290,7 @@ comm_point_create_udp_ancil(struct comm_base *base, int fd,
 		comm_point_delete(c);
 		return NULL;
 	}
+	c->event_added = 1;
 	return c;
 }
 
@@ -3573,6 +3575,7 @@ comm_point_create_tcp(struct comm_base *base, int fd, int num,
 		comm_point_delete(c);
 		return NULL;
 	}
+	c->event_added = 1;
 	/* now prealloc the handlers */
 	for(i=0; i<num; i++) {
 		if(port_type == listen_type_tcp ||
@@ -3796,6 +3799,7 @@ comm_point_create_local(struct comm_base *base, int fd, size_t bufsize,
 		free(c);
 		return NULL;
 	}
+	c->event_added = 1;
 	return c;
 }
 
@@ -3858,6 +3862,7 @@ comm_point_create_raw(struct comm_base* base, int fd, int writing,
 		free(c);
 		return NULL;
 	}
+	c->event_added = 1;
 	return c;
 }
 
@@ -3868,8 +3873,11 @@ comm_point_close(struct comm_point* c)
 		return;
 	if(c->fd != -1) {
 		verbose(5, "comm_point_close of %d: event_del", c->fd);
-		if(ub_event_del(c->ev->ev) != 0) {
-			log_err("could not event_del on close");
+		if(c->event_added) {
+			if(ub_event_del(c->ev->ev) != 0) {
+				log_err("could not event_del on close");
+			}
+			c->event_added = 0;
 		}
 	}
 	tcl_close_connection(c->tcl_addr);
@@ -4018,8 +4026,11 @@ void
 comm_point_stop_listening(struct comm_point* c)
 {
 	verbose(VERB_ALGO, "comm point stop listening %d", c->fd);
-	if(ub_event_del(c->ev->ev) != 0) {
-		log_err("event_del error to stoplisten");
+	if(c->event_added) {
+		if(ub_event_del(c->ev->ev) != 0) {
+			log_err("event_del error to stoplisten");
+		}
+		c->event_added = 0;
 	}
 }
 
@@ -4032,6 +4043,12 @@ comm_point_start_listening(struct comm_point* c, int newfd, int msec)
 		/* no use to start listening no free slots. */
 		return;
 	}
+	if(c->event_added) {
+		if(ub_event_del(c->ev->ev) != 0) {
+			log_err("event_del error to startlisten");
+		}
+		c->event_added = 0;
+	}
 	if(msec != -1 && msec != 0) {
 		if(!c->timeout) {
 			c->timeout = (struct timeval*)malloc(sizeof(
@@ -4071,13 +4088,17 @@ comm_point_start_listening(struct comm_point* c, int newfd, int msec)
 	if(ub_event_add(c->ev->ev, msec==0?NULL:c->timeout) != 0) {
 		log_err("event_add failed. in cpsl.");
 	}
+	c->event_added = 1;
 }
 
 void comm_point_listen_for_rw(struct comm_point* c, int rd, int wr)
 {
 	verbose(VERB_ALGO, "comm point listen_for_rw %d %d", c->fd, wr);
-	if(ub_event_del(c->ev->ev) != 0) {
-		log_err("event_del error to cplf");
+	if(c->event_added) {
+		if(ub_event_del(c->ev->ev) != 0) {
+			log_err("event_del error to cplf");
+		}
+		c->event_added = 0;
 	}
 	ub_event_del_bits(c->ev->ev, UB_EV_READ|UB_EV_WRITE);
 	if(rd) ub_event_add_bits(c->ev->ev, UB_EV_READ);
@@ -4085,6 +4106,7 @@ void comm_point_listen_for_rw(struct comm_point* c, int rd, int wr)
 	if(ub_event_add(c->ev->ev, c->timeout) != 0) {
 		log_err("event_add failed. in cplf.");
 	}
+	c->event_added = 1;
 }
 
 size_t comm_point_get_mem(struct comm_point* c)
diff --git a/util/netevent.h b/util/netevent.h
index 810190683..4a2aa1677 100644
--- a/util/netevent.h
+++ b/util/netevent.h
@@ -166,6 +166,8 @@ struct comm_reply {
 struct comm_point {
 	/** behind the scenes structure, with say libevent info. alloced. */
 	struct internal_event* ev;
+	/** if the event is added or not */
+	int event_added;
 
 	/** file descriptor for communication point */
 	int fd;

From 64cccdb8d512e2d0205dc519bc884fc2ec30a925 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Mon, 4 Jan 2021 14:18:24 +0100
Subject: [PATCH 19/44] - iana portlist updated.

---
 doc/Changelog       | 1 +
 util/iana_ports.inc | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/Changelog b/doc/Changelog
index be7d1756e..093a4b8aa 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,7 @@
 4 January 2021: Wouter
 	- For #376: Fix that comm point event is not double removed or double
 	  added to event map.
+	- iana portlist updated.
 
 16 December 2020: George
 	- Fix error cases when udp-connect is set and send() returns an error
diff --git a/util/iana_ports.inc b/util/iana_ports.inc
index adeafc4ad..875851e6a 100644
--- a/util/iana_ports.inc
+++ b/util/iana_ports.inc
@@ -3575,7 +3575,6 @@
 3977,
 3978,
 3979,
-3980,
 3981,
 3982,
 3983,

From 4c4ca2433c522fd2c5d15a6fa7157791db741921 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Tue, 5 Jan 2021 10:27:13 +0100
Subject: [PATCH 20/44] - Fix #385: autoconf 2.70 impacts unbound build

---
 acx_nlnetlabs.m4     |  63 +++++++--------
 acx_python.m4        |   6 +-
 config.h.in          |   3 +-
 configure            |  45 ++---------
 configure.ac         | 180 ++++++++++++++++++-------------------------
 dnscrypt/dnscrypt.m4 |   2 +-
 dnstap/dnstap.m4     |   2 +-
 doc/Changelog        |   3 +
 8 files changed, 117 insertions(+), 187 deletions(-)

diff --git a/acx_nlnetlabs.m4 b/acx_nlnetlabs.m4
index 31e43d67e..2b7768075 100644
--- a/acx_nlnetlabs.m4
+++ b/acx_nlnetlabs.m4
@@ -2,7 +2,8 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 35
+# Version 36
+# 2021-01-05 autoconf 2.70 autoupdate and fixes, no AC_TRY_COMPILE
 # 2020-08-24 Use EVP_sha256 instead of HMAC_Update (for openssl-3.0.0).
 # 2016-03-21 Check -ldl -pthread for libcrypto for ldns and openssl 1.1.0.
 # 2016-03-21 Use HMAC_Update instead of HMAC_CTX_Init (for openssl-1.1.0).
@@ -447,15 +448,12 @@ AC_DEFUN([ACX_CHECK_FORMAT_ATTRIBUTE],
 AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "format" attribute)
 AC_CACHE_VAL(ac_cv_c_format_attribute,
 [ac_cv_c_format_attribute=no
-AC_TRY_COMPILE(
-[#include <stdio.h>
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>
 void f (char *format, ...) __attribute__ ((format (printf, 1, 2)));
 void (*pf) (char *format, ...) __attribute__ ((format (printf, 1, 2)));
-], [
+]], [[
    f ("%s", "str");
-],
-[ac_cv_c_format_attribute="yes"],
-[ac_cv_c_format_attribute="no"])
+]])],[ac_cv_c_format_attribute="yes"],[ac_cv_c_format_attribute="no"])
 ])
 
 AC_MSG_RESULT($ac_cv_c_format_attribute)
@@ -484,14 +482,11 @@ AC_DEFUN([ACX_CHECK_UNUSED_ATTRIBUTE],
 AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "unused" attribute)
 AC_CACHE_VAL(ac_cv_c_unused_attribute,
 [ac_cv_c_unused_attribute=no
-AC_TRY_COMPILE(
-[#include <stdio.h>
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>
 void f (char *u __attribute__((unused)));
-], [
+]], [[
    f ("x");
-],
-[ac_cv_c_unused_attribute="yes"],
-[ac_cv_c_unused_attribute="no"])
+]])],[ac_cv_c_unused_attribute="yes"],[ac_cv_c_unused_attribute="no"])
 ])
 
 dnl Setup ATTR_UNUSED config.h parts.
@@ -524,8 +519,8 @@ AC_DEFUN([AC_PROG_CXX], [:])
 AC_DEFUN([AC_PROG_CXXCPP], [:])
 AC_DEFUN([AC_PROG_OBJC], [:])
 AC_DEFUN([AC_PROG_OBJCCPP], [:])
-AC_DEFUN([AC_LIBTOOL_CXX], [:])
-AC_DEFUN([AC_LIBTOOL_F77], [:])
+AC_DEFUN([LT_LANG([C++])], [:])
+AC_DEFUN([LT_LANG([Fortran 77])], [:])
 # always use ./libtool unless override from commandline (libtool=mylibtool)
 if test -z "$libtool"; then
 	libtool="./libtool"
@@ -548,7 +543,7 @@ dnl as a requirement so that is gets called before LIBTOOL
 dnl because libtools 'AC_REQUIRE' names are right after this one, before
 dnl this function contents.
 AC_REQUIRE([ACX_LIBTOOL_C_PRE])
-AC_PROG_LIBTOOL
+LT_INIT
 ])
 
 dnl Detect if u_char type is defined, otherwise define it.
@@ -677,14 +672,14 @@ AC_DEFUN([ACX_SSL_CHECKS], [
             AC_MSG_CHECKING([for EVP_sha256 in -lcrypto])
             LIBS="$LIBS -lcrypto"
             LIBSSL_LIBS="$LIBSSL_LIBS -lcrypto"
-            AC_TRY_LINK(, [
+            AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
                 int EVP_sha256(void);
                 (void)EVP_sha256();
-              ], [
+              ]])],[
                 AC_MSG_RESULT(yes)
                 AC_DEFINE([HAVE_EVP_SHA256], 1,
                           [If you have EVP_sha256])
-              ], [
+              ],[
                 AC_MSG_RESULT(no)
                 # check if -lwsock32 or -lgdi32 are needed.	
                 BAKLIBS="$LIBS"
@@ -692,10 +687,10 @@ AC_DEFUN([ACX_SSL_CHECKS], [
 		LIBS="$LIBS -lgdi32 -lws2_32"
 		LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32 -lws2_32"
                 AC_MSG_CHECKING([if -lcrypto needs -lgdi32])
-                AC_TRY_LINK([], [
+                AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
                     int EVP_sha256(void);
                     (void)EVP_sha256();
-                  ],[
+                  ]])],[
                     AC_DEFINE([HAVE_EVP_SHA256], 1,
                         [If you have EVP_sha256])
                     AC_MSG_RESULT(yes) 
@@ -706,10 +701,10 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                     LIBS="$LIBS -ldl"
                     LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
                     AC_MSG_CHECKING([if -lcrypto needs -ldl])
-                    AC_TRY_LINK([], [
+                    AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
                         int EVP_sha256(void);
                         (void)EVP_sha256();
-                      ],[
+                      ]])],[
                         AC_DEFINE([HAVE_EVP_SHA256], 1,
                             [If you have EVP_sha256])
                         AC_MSG_RESULT(yes) 
@@ -720,10 +715,10 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                         LIBS="$LIBS -ldl -pthread"
                         LIBSSL_LIBS="$LIBSSL_LIBS -ldl -pthread"
                         AC_MSG_CHECKING([if -lcrypto needs -ldl -pthread])
-                        AC_TRY_LINK([], [
+                        AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
                             int EVP_sha256(void);
                             (void)EVP_sha256();
-                          ],[
+                          ]])],[
                             AC_DEFINE([HAVE_EVP_SHA256], 1,
                                 [If you have EVP_sha256])
                             AC_MSG_RESULT(yes) 
@@ -750,8 +745,7 @@ dnl Checks main header files of SSL.
 dnl
 AC_DEFUN([ACX_WITH_SSL],
 [
-AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname],
-                                    [enable SSL (will check /usr/local/ssl
+AC_ARG_WITH(ssl, AS_HELP_STRING([--with-ssl=pathname],[enable SSL (will check /usr/local/ssl
                             /usr/lib/ssl /usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw /usr)]),[
         ],[
             withval="yes"
@@ -769,8 +763,7 @@ dnl Checks main header files of SSL.
 dnl
 AC_DEFUN([ACX_WITH_SSL_OPTIONAL],
 [
-AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname],
-                                [enable SSL (will check /usr/local/ssl
+AC_ARG_WITH(ssl, AS_HELP_STRING([--with-ssl=pathname],[enable SSL (will check /usr/local/ssl
                                 /usr/lib/ssl /usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw /usr)]),[
         ],[
             withval="yes"
@@ -1062,7 +1055,7 @@ dnl defines MKDIR_HAS_ONE_ARG
 AC_DEFUN([ACX_MKDIR_ONE_ARG],
 [
 AC_MSG_CHECKING([whether mkdir has one arg])
-AC_TRY_COMPILE([
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 #include <stdio.h>
 #include <unistd.h>
 #ifdef HAVE_WINSOCK2_H
@@ -1071,14 +1064,12 @@ AC_TRY_COMPILE([
 #ifdef HAVE_SYS_STAT_H
 #include <sys/stat.h>
 #endif
-], [
+]], [[
 	(void)mkdir("directory");
-],
-AC_MSG_RESULT(yes)
+]])],[AC_MSG_RESULT(yes)
 AC_DEFINE(MKDIR_HAS_ONE_ARG, 1, [Define if mkdir has one argument.])
-,
-AC_MSG_RESULT(no)
-)
+],[AC_MSG_RESULT(no)
+])
 ])dnl end of ACX_MKDIR_ONE_ARG
 
 dnl Check for ioctlsocket function. works on mingw32 too.
diff --git a/acx_python.m4 b/acx_python.m4
index a84daa035..767db5b65 100644
--- a/acx_python.m4
+++ b/acx_python.m4
@@ -85,11 +85,11 @@ $ac_distutils_result])
 
         LIBS="$LIBS $PYTHON_LDFLAGS"
         CPPFLAGS="$CPPFLAGS $PYTHON_CPPFLAGS"
-        AC_TRY_LINK([
+        AC_LINK_IFELSE([AC_LANG_PROGRAM([[
                 #include <Python.h>
-        ],[
+        ]],[[
                 Py_Initialize();
-        ],[pythonexists=yes],[pythonexists=no])
+        ]])],[pythonexists=yes],[pythonexists=no])
 
         AC_MSG_RESULT([$pythonexists])
 
diff --git a/config.h.in b/config.h.in
index f993b81b0..103ad9f00 100644
--- a/config.h.in
+++ b/config.h.in
@@ -747,7 +747,8 @@
    your system. */
 #undef PTHREAD_CREATE_JOINABLE
 
-/* Define as the return type of signal handlers (`int' or `void'). */
+/* Return type of signal handlers, but autoconf 2.70 says 'your code may
+   safely assume C89 semantics that RETSIGTYPE is void.' */
 #undef RETSIGTYPE
 
 /* if REUSEPORT is enabled by default */
diff --git a/configure b/configure
index 00d36a361..87959deae 100755
--- a/configure
+++ b/configure
@@ -4177,7 +4177,6 @@ $as_echo "$ac_cv_safe_to_define___extensions__" >&6; }
   $as_echo "#define _TANDEM_SOURCE 1" >>confdefs.h
 
 
-
 if test "$ac_cv_header_minix_config_h" = "yes"; then
 
 $as_echo "#define _NETBSD_SOURCE 1" >>confdefs.h
@@ -15596,38 +15595,8 @@ $as_echo "#define HAVE_WORKING_FORK 1" >>confdefs.h
 
 fi
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking return type of signal handlers" >&5
-$as_echo_n "checking return type of signal handlers... " >&6; }
-if ${ac_cv_type_signal+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <sys/types.h>
-#include <signal.h>
-
-int
-main ()
-{
-return *(signal (0, 0)) (0) == 1;
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-  ac_cv_type_signal=int
-else
-  ac_cv_type_signal=void
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_signal" >&5
-$as_echo "$ac_cv_type_signal" >&6; }
-
-cat >>confdefs.h <<_ACEOF
-#define RETSIGTYPE $ac_cv_type_signal
-_ACEOF
 
+$as_echo "#define RETSIGTYPE void" >>confdefs.h
 
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for _LARGEFILE_SOURCE value needed for large files" >&5
 $as_echo_n "checking for _LARGEFILE_SOURCE value needed for large files... " >&6; }
@@ -18288,17 +18257,13 @@ $as_echo_n "checking if libssl needs -lcrypt32... " >&6; }
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
-/* Override any GCC internal prototype to avoid an error.
-   Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-char EVP_sha256 ();
 int
 main ()
 {
-return EVP_sha256 ();
+
+	int EVP_sha256(void);
+	(void)EVP_sha256();
+
   ;
   return 0;
 }
diff --git a/configure.ac b/configure.ac
index d648f55ad..02b9eb47b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,6 +1,6 @@
 #                                               -*- Autoconf -*-
 # Process this file with autoconf to produce a configure script.
-AC_PREREQ(2.56)
+AC_PREREQ([2.56])
 sinclude(acx_nlnetlabs.m4)
 sinclude(ax_pthread.m4)
 sinclude(acx_python.m4)
@@ -12,7 +12,7 @@ sinclude(dnscrypt/dnscrypt.m4)
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[13])
 m4_define([VERSION_MICRO],[1])
-AC_INIT(unbound, m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]), unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues, unbound)
+AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
@@ -126,7 +126,7 @@ cmdln="`echo $@ | sed -e 's/\\\\/\\\\\\\\/g' | sed -e 's/"/\\\\"/'g`"
 AC_DEFINE_UNQUOTED(CONFCMDLINE, ["$cmdln"], [Command line arguments used with configure])
 
 CFLAGS="$CFLAGS"
-AC_AIX
+AC_USE_SYSTEM_EXTENSIONS
 if test "$ac_cv_header_minix_config_h" = "yes"; then
 	AC_DEFINE(_NETBSD_SOURCE,1, [Enable for compile on Minix])
 fi
@@ -167,8 +167,7 @@ else
   ub_conf_file="C:\\Program Files\\Unbound\\service.conf"
 fi
 AC_ARG_WITH([conf_file],
-        AC_HELP_STRING([--with-conf-file=path], 
-	[Pathname to the Unbound configuration file]),
+        AS_HELP_STRING([--with-conf-file=path],[Pathname to the Unbound configuration file]),
 	[ub_conf_file="$withval"])
 AC_SUBST(ub_conf_file)
 ACX_ESCAPE_BACKSLASH($ub_conf_file, hdr_config)
@@ -178,8 +177,7 @@ AC_SUBST(ub_conf_dir)
 
 # Determine run, chroot directory and pidfile locations
 AC_ARG_WITH(run-dir, 
-    AC_HELP_STRING([--with-run-dir=path], 
-    [set default directory to chdir to (by default dir part of cfg file)]), 
+    AS_HELP_STRING([--with-run-dir=path],[set default directory to chdir to (by default dir part of cfg file)]), 
     UNBOUND_RUN_DIR="$withval", 
 if test $on_mingw = no; then
     UNBOUND_RUN_DIR=`dirname "$ub_conf_file"`
@@ -192,8 +190,7 @@ ACX_ESCAPE_BACKSLASH($UNBOUND_RUN_DIR, hdr_run)
 AC_DEFINE_UNQUOTED(RUN_DIR, ["$hdr_run"], [Directory to chdir to])
 
 AC_ARG_WITH(chroot-dir, 
-    AC_HELP_STRING([--with-chroot-dir=path], 
-    [set default directory to chroot to (by default same as run-dir)]), 
+    AS_HELP_STRING([--with-chroot-dir=path],[set default directory to chroot to (by default same as run-dir)]), 
     UNBOUND_CHROOT_DIR="$withval", 
 if test $on_mingw = no; then
     UNBOUND_CHROOT_DIR="$UNBOUND_RUN_DIR"
@@ -206,16 +203,14 @@ ACX_ESCAPE_BACKSLASH($UNBOUND_CHROOT_DIR, hdr_chroot)
 AC_DEFINE_UNQUOTED(CHROOT_DIR, ["$hdr_chroot"], [Directory to chroot to])
 
 AC_ARG_WITH(share-dir,
-    AC_HELP_STRING([--with-share-dir=path],
-    [set default directory with shared data (by default same as share/unbound)]),
+    AS_HELP_STRING([--with-share-dir=path],[set default directory with shared data (by default same as share/unbound)]),
     UNBOUND_SHARE_DIR="$withval",
     UNBOUND_SHARE_DIR="$UNBOUND_RUN_DIR")
 AC_SUBST(UNBOUND_SHARE_DIR)
 AC_DEFINE_UNQUOTED(SHARE_DIR, ["$UNBOUND_SHARE_DIR"], [Shared data])
 
 AC_ARG_WITH(pidfile, 
-    AC_HELP_STRING([--with-pidfile=filename], 
-    [set default pathname to unbound pidfile (default run-dir/unbound.pid)]), 
+    AS_HELP_STRING([--with-pidfile=filename],[set default pathname to unbound pidfile (default run-dir/unbound.pid)]), 
     UNBOUND_PIDFILE="$withval", 
 if test $on_mingw = no; then
     UNBOUND_PIDFILE="$UNBOUND_RUN_DIR/unbound.pid"
@@ -228,8 +223,7 @@ ACX_ESCAPE_BACKSLASH($UNBOUND_PIDFILE, hdr_pid)
 AC_DEFINE_UNQUOTED(PIDFILE, ["$hdr_pid"], [default pidfile location])
 
 AC_ARG_WITH(rootkey-file, 
-    AC_HELP_STRING([--with-rootkey-file=filename], 
-    [set default pathname to root key file (default run-dir/root.key). This file is read and written.]), 
+    AS_HELP_STRING([--with-rootkey-file=filename],[set default pathname to root key file (default run-dir/root.key). This file is read and written.]), 
     UNBOUND_ROOTKEY_FILE="$withval", 
 if test $on_mingw = no; then
     UNBOUND_ROOTKEY_FILE="$UNBOUND_RUN_DIR/root.key"
@@ -242,8 +236,7 @@ ACX_ESCAPE_BACKSLASH($UNBOUND_ROOTKEY_FILE, hdr_rkey)
 AC_DEFINE_UNQUOTED(ROOT_ANCHOR_FILE, ["$hdr_rkey"], [default rootkey location])
 
 AC_ARG_WITH(rootcert-file, 
-    AC_HELP_STRING([--with-rootcert-file=filename], 
-    [set default pathname to root update certificate file (default run-dir/icannbundle.pem).  This file need not exist if you are content with the builtin.]), 
+    AS_HELP_STRING([--with-rootcert-file=filename],[set default pathname to root update certificate file (default run-dir/icannbundle.pem).  This file need not exist if you are content with the builtin.]), 
     UNBOUND_ROOTCERT_FILE="$withval", 
 if test $on_mingw = no; then
     UNBOUND_ROOTCERT_FILE="$UNBOUND_RUN_DIR/icannbundle.pem"
@@ -256,8 +249,7 @@ ACX_ESCAPE_BACKSLASH($UNBOUND_ROOTCERT_FILE, hdr_rpem)
 AC_DEFINE_UNQUOTED(ROOT_CERT_FILE, ["$hdr_rpem"], [default rootcert location])
 
 AC_ARG_WITH(username, 
-    AC_HELP_STRING([--with-username=user], 
-    [set default user that unbound changes to (default user is unbound)]), 
+    AS_HELP_STRING([--with-username=user],[set default user that unbound changes to (default user is unbound)]), 
     UNBOUND_USERNAME="$withval", 
     UNBOUND_USERNAME="unbound")
 AC_SUBST(UNBOUND_USERNAME)
@@ -269,7 +261,7 @@ AC_DEFINE_UNQUOTED(RSRC_PACKAGE_VERSION, [$wnvs], [version number for resource f
 
 # Checks for typedefs, structures, and compiler characteristics.
 AC_C_CONST
-AC_LANG_C
+AC_LANG([C])
 # allow user to override the -g -O2 flags.
 default_cflags=no
 if test "x$CFLAGS" = "x" ; then
@@ -282,8 +274,8 @@ ACX_DEPFLAG
 ACX_DETERMINE_EXT_FLAGS_UNBOUND
 
 # debug mode flags warnings
-AC_ARG_ENABLE(checking, AC_HELP_STRING([--enable-checking], [Enable warnings, asserts, makefile-dependencies]))
-AC_ARG_ENABLE(debug, AC_HELP_STRING([--enable-debug], [same as enable-checking]))
+AC_ARG_ENABLE(checking, AS_HELP_STRING([--enable-checking],[Enable warnings, asserts, makefile-dependencies]))
+AC_ARG_ENABLE(debug, AS_HELP_STRING([--enable-debug],[same as enable-checking]))
 if test "$enable_debug" = "yes"; then debug_enabled="$enable_debug"; 
 else debug_enabled="$enable_checking"; fi
 AC_SUBST(debug_enabled)
@@ -317,14 +309,11 @@ AC_DEFUN([CHECK_WEAK_ATTRIBUTE],
 AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "weak" attribute)
 AC_CACHE_VAL(ac_cv_c_weak_attribute,
 [ac_cv_c_weak_attribute=no
-AC_TRY_COMPILE(
-[ #include <stdio.h>
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h>
 __attribute__((weak)) void f(int x) { printf("%d", x); }
-], [
+]], [[
    f(1);
-],
-[ac_cv_c_weak_attribute="yes"],
-[ac_cv_c_weak_attribute="no"])
+]])],[ac_cv_c_weak_attribute="yes"],[ac_cv_c_weak_attribute="no"])
 ])
 
 AC_MSG_RESULT($ac_cv_c_weak_attribute)
@@ -341,14 +330,11 @@ AC_DEFUN([CHECK_NORETURN_ATTRIBUTE],
 AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "noreturn" attribute)
 AC_CACHE_VAL(ac_cv_c_noreturn_attribute,
 [ac_cv_c_noreturn_attribute=no
-AC_TRY_COMPILE(
-[ #include <stdio.h>
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h>
 __attribute__((noreturn)) void f(int x) { printf("%d", x); }
-], [
+]], [[
    f(1);
-],
-[ac_cv_c_noreturn_attribute="yes"],
-[ac_cv_c_noreturn_attribute="no"])
+]])],[ac_cv_c_noreturn_attribute="yes"],[ac_cv_c_noreturn_attribute="no"])
 ])
 
 AC_MSG_RESULT($ac_cv_c_noreturn_attribute)
@@ -386,7 +372,7 @@ EOF
 	fi
 ])
 
-AC_PROG_LEX
+AC_PROG_LEX([noyywrap])
 if test "$LEX" != "" -a "$LEX" != ":"; then
 ACX_YYLEX_DESTROY
 fi
@@ -495,7 +481,7 @@ fi
 # check some functions of the OS before linking libs (while still runnable).
 AC_FUNC_CHOWN
 AC_FUNC_FORK
-AC_TYPE_SIGNAL
+AC_DEFINE(RETSIGTYPE,void,[Return type of signal handlers, but autoconf 2.70 says 'your code may safely assume C89 semantics that RETSIGTYPE is void.'])
 AC_FUNC_FSEEKO
 ACX_SYS_LARGEFILE
 ACX_CHECK_NONBLOCKING_BROKEN
@@ -514,14 +500,11 @@ sinclude(systemd.m4)
 # Include systemd.m4 - end
 
 # set memory allocation checking if requested
-AC_ARG_ENABLE(alloc-checks, AC_HELP_STRING([--enable-alloc-checks],
-	[ enable to memory allocation statistics, for debug purposes ]), 
+AC_ARG_ENABLE(alloc-checks, AS_HELP_STRING([--enable-alloc-checks],[ enable to memory allocation statistics, for debug purposes ]), 
 	, )
-AC_ARG_ENABLE(alloc-lite, AC_HELP_STRING([--enable-alloc-lite],
-	[ enable for lightweight alloc assertions, for debug purposes ]), 
+AC_ARG_ENABLE(alloc-lite, AS_HELP_STRING([--enable-alloc-lite],[ enable for lightweight alloc assertions, for debug purposes ]), 
 	, )
-AC_ARG_ENABLE(alloc-nonregional, AC_HELP_STRING([--enable-alloc-nonregional],
-	[ enable nonregional allocs, slow but exposes regional allocations to other memory purifiers, for debug purposes ]), 
+AC_ARG_ENABLE(alloc-nonregional, AS_HELP_STRING([--enable-alloc-nonregional],[ enable nonregional allocs, slow but exposes regional allocations to other memory purifiers, for debug purposes ]), 
 	, )
 if test x_$enable_alloc_nonregional = x_yes; then
 	AC_DEFINE(UNBOUND_ALLOC_NONREGIONAL, 1, [use malloc not regions, for debug use])
@@ -565,8 +548,7 @@ else
 # check this first, so that the pthread lib does not get linked in via
 # libssl or libpython, and thus distorts the tests, and we end up using
 # the non-threadsafe C libraries.
-AC_ARG_WITH(pthreads, AC_HELP_STRING([--with-pthreads], 
- [use pthreads library, or --without-pthreads to disable threading support.]), 
+AC_ARG_WITH(pthreads, AS_HELP_STRING([--with-pthreads],[use pthreads library, or --without-pthreads to disable threading support.]), 
  [ ],[ withval="yes" ])
 ub_have_pthreads=no
 if test x_$withval != x_no; then
@@ -613,12 +595,11 @@ int main(void) {return 0;}
 fi
 
 # check solaris thread library 
-AC_ARG_WITH(solaris-threads, AC_HELP_STRING([--with-solaris-threads], 
-	[use solaris native thread library.]), [ ],[ withval="no" ])
+AC_ARG_WITH(solaris-threads, AS_HELP_STRING([--with-solaris-threads],[use solaris native thread library.]), [ ],[ withval="no" ])
 ub_have_sol_threads=no
 if test x_$withval != x_no; then
 	if test x_$ub_have_pthreads != x_no; then
-	    AC_WARN([Have pthreads already, ignoring --with-solaris-threads])
+	    AC_MSG_WARN([Have pthreads already, ignoring --with-solaris-threads])
 	else
 	AC_SEARCH_LIBS(thr_create, [thread],
 	[
@@ -628,7 +609,7 @@ if test x_$withval != x_no; then
 			[CFLAGS="$CFLAGS -D_REENTRANT"])
 		ub_have_sol_threads=yes
 	] , [ 
-		AC_ERROR([no solaris threads found.]) 
+		AC_MSG_ERROR([no solaris threads found.]) 
 	])
 	fi
 fi
@@ -636,7 +617,7 @@ fi
 fi # end of non-mingw check of thread libraries
 
 # Check for SYSLOG_FACILITY
-AC_ARG_WITH(syslog-facility, AC_HELP_STRING([--with-syslog-facility=LOCAL0 - LOCAL7], [ set SYSLOG_FACILITY, default DAEMON ]),
+AC_ARG_WITH(syslog-facility, AS_HELP_STRING([--with-syslog-facility=LOCAL0 - LOCAL7],[ set SYSLOG_FACILITY, default DAEMON ]),
 	[ UNBOUND_SYSLOG_FACILITY="$withval" ], [])
 case "${UNBOUND_SYSLOG_FACILITY}" in
 
@@ -649,8 +630,7 @@ AC_DEFINE_UNQUOTED(UB_SYSLOG_FACILITY,${UNBOUND_SYSLOG_FACILITY},[the SYSLOG_FAC
 
 # Check for dynamic library module
 AC_ARG_WITH(dynlibmodule,
-   AC_HELP_STRING([--with-dynlibmodule],
-   [build dynamic library module, or --without-dynlibmodule to disable it. (default=no)]),
+   AS_HELP_STRING([--with-dynlibmodule],[build dynamic library module, or --without-dynlibmodule to disable it. (default=no)]),
    [], [ withval="no" ])
 
 if test x_$withval != x_no; then
@@ -671,8 +651,7 @@ fi
 
 # Check for PyUnbound
 AC_ARG_WITH(pyunbound,
-   AC_HELP_STRING([--with-pyunbound],
-   [build PyUnbound, or --without-pyunbound to skip it. (default=no)]),
+   AS_HELP_STRING([--with-pyunbound],[build PyUnbound, or --without-pyunbound to skip it. (default=no)]),
    [], [ withval="no" ])
 
 ub_test_python=no
@@ -684,8 +663,7 @@ fi
 
 # Check for Python module
 AC_ARG_WITH(pythonmodule,
-   AC_HELP_STRING([--with-pythonmodule],
-   [build Python module, or --without-pythonmodule to disable script engine. (default=no)]),
+   AS_HELP_STRING([--with-pythonmodule],[build Python module, or --without-pythonmodule to disable script engine. (default=no)]),
    [], [ withval="no" ])
 
 ub_with_pythonmod=no
@@ -703,7 +681,7 @@ if test x_$ub_test_python != x_no; then
    AC_PYTHON_DEVEL
    if test ! -z "$PYTHON_VERSION"; then
 	if test `$PYTHON -c "print('$PYTHON_VERSION' >= '2.4.0')"` = "False"; then
-		AC_ERROR([Python version >= 2.4.0 is required])
+		AC_MSG_ERROR([Python version >= 2.4.0 is required])
 	fi
 
       [PY_MAJOR_VERSION="`$PYTHON -c \"import sys; print(sys.version_info[0])\"`"]
@@ -731,7 +709,7 @@ if test x_$ub_test_python != x_no; then
 
       # Check for SWIG
       ub_have_swig=no
-      AC_ARG_ENABLE(swig-version-check, AC_HELP_STRING([--disable-swig-version-check], [Disable swig version check to build python modules with older swig even though that is unreliable]))
+      AC_ARG_ENABLE(swig-version-check, AS_HELP_STRING([--disable-swig-version-check],[Disable swig version check to build python modules with older swig even though that is unreliable]))
       if test "$enable_swig_version_check" = "yes"; then
       	AC_PROG_SWIG(2.0.1)
       else
@@ -739,7 +717,7 @@ if test x_$ub_test_python != x_no; then
       fi
       AC_MSG_CHECKING(SWIG)
       if test ! -x "$SWIG"; then
-         AC_ERROR([failed to find swig tool, install it, or do not build Python module and PyUnbound])
+         AC_MSG_ERROR([failed to find swig tool, install it, or do not build Python module and PyUnbound])
       else
          AC_DEFINE(HAVE_SWIG, 1, [Define if you have Swig libraries and header files.])
          AC_SUBST(swig, "$SWIG")
@@ -794,8 +772,7 @@ AC_SUBST(CONFIG_DATE)
 
 # libnss
 USE_NSS="no"
-AC_ARG_WITH([nss], AC_HELP_STRING([--with-nss=path],
-	[use libnss instead of openssl, installed at path.]),
+AC_ARG_WITH([nss], AS_HELP_STRING([--with-nss=path],[use libnss instead of openssl, installed at path.]),
 	[
 	USE_NSS="yes"
 	AC_DEFINE(HAVE_NSS, 1, [Use libnss for crypto])
@@ -817,8 +794,7 @@ AC_ARG_WITH([nss], AC_HELP_STRING([--with-nss=path],
 
 # libnettle
 USE_NETTLE="no"
-AC_ARG_WITH([nettle], AC_HELP_STRING([--with-nettle=path],
-	[use libnettle as crypto library, installed at path.]),
+AC_ARG_WITH([nettle], AS_HELP_STRING([--with-nettle=path],[use libnettle as crypto library, installed at path.]),
 	[
 	USE_NETTLE="yes"
 	AC_DEFINE(HAVE_NETTLE, 1, [Use libnettle for crypto])
@@ -850,7 +826,10 @@ AC_SUBST(PC_CRYPTO_DEPENDENCY)
 BAKLIBS="$LIBS"
 LIBS="-lssl $LIBS"
 AC_MSG_CHECKING([if libssl needs -lcrypt32])
-AC_TRY_LINK_FUNC([EVP_sha256], [
+AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
+	int EVP_sha256(void);
+	(void)EVP_sha256();
+]])], [
 	AC_MSG_RESULT([no])
 	LIBS="$BAKLIBS"
 ], [
@@ -938,7 +917,7 @@ fi
 AC_SUBST(SSLLIB)
 
 # libbsd
-AC_ARG_WITH([libbsd], AC_HELP_STRING([--with-libbsd], [Use portable libbsd functions]), [
+AC_ARG_WITH([libbsd], AS_HELP_STRING([--with-libbsd],[Use portable libbsd functions]), [
 	AC_CHECK_HEADERS([bsd/string.h bsd/stdlib.h],,, [AC_INCLUDES_DEFAULT])
 	if test "x$ac_cv_header_bsd_string_h" = xyes -a "x$ac_cv_header_bsd_stdlib_h" = xyes; then
 		for func in strlcpy strlcat arc4random arc4random_uniform reallocarray; do
@@ -951,7 +930,7 @@ AC_ARG_WITH([libbsd], AC_HELP_STRING([--with-libbsd], [Use portable libbsd funct
 	fi
 ])
 
-AC_ARG_ENABLE(sha1, AC_HELP_STRING([--disable-sha1], [Disable SHA1 RRSIG support, does not disable nsec3 support]))
+AC_ARG_ENABLE(sha1, AS_HELP_STRING([--disable-sha1],[Disable SHA1 RRSIG support, does not disable nsec3 support]))
 case "$enable_sha1" in
 	no)
 	;;
@@ -961,7 +940,7 @@ case "$enable_sha1" in
 esac
 
 
-AC_ARG_ENABLE(sha2, AC_HELP_STRING([--disable-sha2], [Disable SHA256 and SHA512 RRSIG support]))
+AC_ARG_ENABLE(sha2, AS_HELP_STRING([--disable-sha2],[Disable SHA256 and SHA512 RRSIG support]))
 case "$enable_sha2" in
 	no)
 	;;
@@ -970,7 +949,7 @@ case "$enable_sha2" in
 	;;
 esac
 
-AC_ARG_ENABLE(subnet, AC_HELP_STRING([--enable-subnet], [Enable client subnet]))
+AC_ARG_ENABLE(subnet, AS_HELP_STRING([--enable-subnet],[Enable client subnet]))
 case "$enable_subnet" in
 	yes)
 	AC_DEFINE([CLIENT_SUBNET], [1], [Define this to enable client subnet option.])
@@ -1081,7 +1060,7 @@ fi
 AC_MSG_RESULT($ac_cv_c_gost_works)
 ])dnl
 
-AC_ARG_ENABLE(gost, AC_HELP_STRING([--disable-gost], [Disable GOST support]))
+AC_ARG_ENABLE(gost, AS_HELP_STRING([--disable-gost],[Disable GOST support]))
 use_gost="no"
 if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
 case "$enable_gost" in
@@ -1099,7 +1078,7 @@ case "$enable_gost" in
 esac
 fi dnl !USE_NSS && !USE_NETTLE
 
-AC_ARG_ENABLE(ecdsa, AC_HELP_STRING([--disable-ecdsa], [Disable ECDSA support]))
+AC_ARG_ENABLE(ecdsa, AS_HELP_STRING([--disable-ecdsa],[Disable ECDSA support]))
 use_ecdsa="no"
 case "$enable_ecdsa" in
     no)
@@ -1131,7 +1110,7 @@ case "$enable_ecdsa" in
       ;;
 esac
 
-AC_ARG_ENABLE(dsa, AC_HELP_STRING([--disable-dsa], [Disable DSA support]))
+AC_ARG_ENABLE(dsa, AS_HELP_STRING([--disable-dsa],[Disable DSA support]))
 use_dsa="no"
 case "$enable_dsa" in
     yes)
@@ -1171,7 +1150,7 @@ AC_INCLUDES_DEFAULT
       ;;
 esac
 
-AC_ARG_ENABLE(ed25519, AC_HELP_STRING([--disable-ed25519], [Disable ED25519 support]))
+AC_ARG_ENABLE(ed25519, AS_HELP_STRING([--disable-ed25519],[Disable ED25519 support]))
 use_ed25519="no"
 case "$enable_ed25519" in
     no)
@@ -1194,7 +1173,7 @@ case "$enable_ed25519" in
       ;;
 esac
 
-AC_ARG_ENABLE(ed448, AC_HELP_STRING([--disable-ed448], [Disable ED448 support]))
+AC_ARG_ENABLE(ed448, AS_HELP_STRING([--disable-ed448],[Disable ED448 support]))
 use_ed448="no"
 case "$enable_ed448" in
     no)
@@ -1214,7 +1193,7 @@ case "$enable_ed448" in
       ;;
 esac
 
-AC_ARG_ENABLE(event-api, AC_HELP_STRING([--enable-event-api], [Enable (experimental) pluggable event base libunbound API installed to unbound-event.h]))
+AC_ARG_ENABLE(event-api, AS_HELP_STRING([--enable-event-api],[Enable (experimental) pluggable event base libunbound API installed to unbound-event.h]))
 case "$enable_event_api" in
     yes)
       AC_SUBST(UNBOUND_EVENT_INSTALL, [unbound-event-install])
@@ -1224,7 +1203,7 @@ case "$enable_event_api" in
       ;;
 esac
 
-AC_ARG_ENABLE(tfo-client, AC_HELP_STRING([--enable-tfo-client], [Enable TCP Fast Open for client mode]))
+AC_ARG_ENABLE(tfo-client, AS_HELP_STRING([--enable-tfo-client],[Enable TCP Fast Open for client mode]))
 case "$enable_tfo_client" in
 	yes)
 		case `uname` in
@@ -1248,7 +1227,7 @@ case "$enable_tfo_client" in
 		;;
 esac
 
-AC_ARG_ENABLE(tfo-server, AC_HELP_STRING([--enable-tfo-server], [Enable TCP Fast Open for server mode]))
+AC_ARG_ENABLE(tfo-server, AS_HELP_STRING([--enable-tfo-server],[Enable TCP Fast Open for server mode]))
 case "$enable_tfo_server" in
 	yes)
 	      AC_CHECK_DECL([TCP_FASTOPEN], [AC_MSG_WARN([Check the platform specific TFO kernel parameters are correctly configured to support server mode TFO])], [AC_MSG_ERROR([TCP Fast Open is not available for server mode: please rerun without --enable-tfo-server])], [AC_INCLUDES_DEFAULT
@@ -1261,8 +1240,7 @@ case "$enable_tfo_server" in
 esac
 
 # check for libevent
-AC_ARG_WITH(libevent, AC_HELP_STRING([--with-libevent=pathname],
-    [use libevent (will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr  or you can specify an explicit path). Slower, but allows use of large outgoing port ranges.]),
+AC_ARG_WITH(libevent, AS_HELP_STRING([--with-libevent=pathname],[use libevent (will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr  or you can specify an explicit path). Slower, but allows use of large outgoing port ranges.]),
     [ ],[ with_libevent="no" ])
 if test "x_$with_libevent" != x_no; then
         AC_DEFINE([USE_LIBEVENT], [1], [Define if you enable libevent])
@@ -1356,8 +1334,7 @@ else
 fi
 
 # check for libexpat
-AC_ARG_WITH(libexpat, AC_HELP_STRING([--with-libexpat=path],
-    [specify explicit path for libexpat.]),
+AC_ARG_WITH(libexpat, AS_HELP_STRING([--with-libexpat=path],[specify explicit path for libexpat.]),
     [ ],[ withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr" ])
 AC_MSG_CHECKING(for libexpat)
 found_libexpat="no"
@@ -1374,7 +1351,7 @@ for dir in $withval ; do
             fi
 done
 if test x_$found_libexpat != x_yes; then
-	AC_ERROR([Could not find libexpat, expat.h])
+	AC_MSG_ERROR([Could not find libexpat, expat.h])
 fi
 AC_CHECK_HEADERS([expat.h],,, [AC_INCLUDES_DEFAULT])
 AC_CHECK_DECLS([XML_StopParser], [], [], [AC_INCLUDES_DEFAULT
@@ -1382,8 +1359,7 @@ AC_CHECK_DECLS([XML_StopParser], [], [], [AC_INCLUDES_DEFAULT
 ])
 
 # hiredis (redis C client for cachedb)
-AC_ARG_WITH(libhiredis, AC_HELP_STRING([--with-libhiredis=path],
-    [specify explicit path for libhiredis.]),
+AC_ARG_WITH(libhiredis, AS_HELP_STRING([--with-libhiredis=path],[specify explicit path for libhiredis.]),
     [ ],[ withval="no" ])
 found_libhiredis="no"
 if test x_$withval = x_yes -o x_$withval != x_no; then
@@ -1406,7 +1382,7 @@ if test x_$withval = x_yes -o x_$withval != x_no; then
             fi
     done
     if test x_$found_libhiredis != x_yes; then
-	AC_ERROR([Could not find libhiredis, hiredis.h])
+	AC_MSG_ERROR([Could not find libhiredis, hiredis.h])
     fi
     AC_CHECK_HEADERS([hiredis/hiredis.h],,, [AC_INCLUDES_DEFAULT])
     AC_CHECK_DECLS([redisConnect], [], [], [AC_INCLUDES_DEFAULT
@@ -1415,8 +1391,7 @@ if test x_$withval = x_yes -o x_$withval != x_no; then
 fi
 
 # nghttp2
-AC_ARG_WITH(libnghttp2, AC_HELP_STRING([--with-libnghttp2=path],
-    [specify explicit path for libnghttp2.]),
+AC_ARG_WITH(libnghttp2, AS_HELP_STRING([--with-libnghttp2=path],[specify explicit path for libnghttp2.]),
     [ ],[ withval="no" ])
 found_libnghttp2="no"
 if test x_$withval = x_yes -o x_$withval != x_no; then
@@ -1439,7 +1414,7 @@ if test x_$withval = x_yes -o x_$withval != x_no; then
             fi
     done
     if test x_$found_libnghttp2 != x_yes; then
-	AC_ERROR([Could not find libnghttp2, nghttp2.h])
+	AC_MSG_ERROR([Could not find libnghttp2, nghttp2.h])
     fi
     AC_CHECK_HEADERS([nghttp2/nghttp2.h],,, [AC_INCLUDES_DEFAULT])
     AC_CHECK_DECLS([nghttp2_session_server_new], [], [], [AC_INCLUDES_DEFAULT
@@ -1450,8 +1425,7 @@ fi
 # set static linking for uninstalled libraries if requested
 AC_SUBST(staticexe)
 staticexe=""
-AC_ARG_ENABLE(static-exe, AC_HELP_STRING([--enable-static-exe],
-	[ enable to compile executables statically against (event) uninstalled libs, for debug purposes ]),
+AC_ARG_ENABLE(static-exe, AS_HELP_STRING([--enable-static-exe],[ enable to compile executables statically against (event) uninstalled libs, for debug purposes ]),
 	, )
 if test x_$enable_static_exe = x_yes; then
 	staticexe="-static"
@@ -1468,8 +1442,7 @@ if test x_$enable_static_exe = x_yes; then
 fi
 
 # set full static linking if requested
-AC_ARG_ENABLE(fully-static, AC_HELP_STRING([--enable-fully-static],
-	[ enable to compile fully static ]),
+AC_ARG_ENABLE(fully-static, AS_HELP_STRING([--enable-fully-static],[ enable to compile fully static ]),
 	, )
 if test x_$enable_fully_static = x_yes; then
 	staticexe="-all-static"
@@ -1485,8 +1458,7 @@ if test x_$enable_fully_static = x_yes; then
 fi
 
 # set lock checking if requested
-AC_ARG_ENABLE(lock_checks, AC_HELP_STRING([--enable-lock-checks],
-	[ enable to check lock and unlock calls, for debug purposes ]), 
+AC_ARG_ENABLE(lock_checks, AS_HELP_STRING([--enable-lock-checks],[ enable to check lock and unlock calls, for debug purposes ]), 
 	, )
 if test x_$enable_lock_checks = x_yes; then
 	AC_DEFINE(ENABLE_LOCK_CHECKS, 1, [Define if you want to use debug lock checking (slow).])
@@ -1728,7 +1700,7 @@ AC_SUBST(LIBOBJ_WITHOUT_CTIME)
 AC_REPLACE_FUNCS(ctime_r)
 AC_REPLACE_FUNCS(strsep)
 
-AC_ARG_ENABLE(allsymbols, AC_HELP_STRING([--enable-allsymbols], [export all symbols from libunbound and link binaries to it, smaller install size but libunbound export table is polluted by internal symbols]))
+AC_ARG_ENABLE(allsymbols, AS_HELP_STRING([--enable-allsymbols],[export all symbols from libunbound and link binaries to it, smaller install size but libunbound export table is polluted by internal symbols]))
 case "$enable_allsymbols" in
 	yes)
 	COMMON_OBJ_ALL_SYMBOLS=""
@@ -1794,7 +1766,7 @@ dnsc_DNSCRYPT([
 )
 
 # check for cachedb if requested
-AC_ARG_ENABLE(cachedb, AC_HELP_STRING([--enable-cachedb], [enable cachedb module that can use external cache storage]))
+AC_ARG_ENABLE(cachedb, AS_HELP_STRING([--enable-cachedb],[enable cachedb module that can use external cache storage]))
 # turn on cachedb when hiredis support is enabled.
 if test "$found_libhiredis" = "yes"; then enable_cachedb="yes"; fi
 case "$enable_cachedb" in
@@ -1807,7 +1779,7 @@ case "$enable_cachedb" in
 esac
 
 # check for ipsecmod if requested
-AC_ARG_ENABLE(ipsecmod, AC_HELP_STRING([--enable-ipsecmod], [Enable ipsecmod module that facilitates opportunistic IPsec]))
+AC_ARG_ENABLE(ipsecmod, AS_HELP_STRING([--enable-ipsecmod],[Enable ipsecmod module that facilitates opportunistic IPsec]))
 case "$enable_ipsecmod" in
 	yes)
 		AC_DEFINE([USE_IPSECMOD], [1], [Define to 1 to use ipsecmod support.])
@@ -1822,7 +1794,7 @@ case "$enable_ipsecmod" in
 esac
 
 # check for ipset if requested
-AC_ARG_ENABLE(ipset, AC_HELP_STRING([--enable-ipset], [enable ipset module]))
+AC_ARG_ENABLE(ipset, AS_HELP_STRING([--enable-ipset],[enable ipset module]))
 case "$enable_ipset" in
     yes)
 		AC_DEFINE([USE_IPSET], [1], [Define to 1 to use ipset support])
@@ -1832,8 +1804,7 @@ case "$enable_ipset" in
 		AC_SUBST(IPSET_OBJ)
 
 		# mnl
-		AC_ARG_WITH(libmnl, AC_HELP_STRING([--with-libmnl=path],
-			[specify explicit path for libmnl.]),
+		AC_ARG_WITH(libmnl, AS_HELP_STRING([--with-libmnl=path],[specify explicit path for libmnl.]),
 			[ ],[ withval="yes" ])
 		found_libmnl="no"
 		AC_MSG_CHECKING(for libmnl)
@@ -1854,14 +1825,14 @@ case "$enable_ipset" in
 			fi
 		done
 		if test x_$found_libmnl != x_yes; then
-			AC_ERROR([Could not find libmnl, libmnl.h])
+			AC_MSG_ERROR([Could not find libmnl, libmnl.h])
 		fi
 		;;
     no|*)
     	# nothing
 		;;
 esac
-AC_ARG_ENABLE(explicit-port-randomisation, AC_HELP_STRING([--disable-explicit-port-randomisation], [disable explicit source port randomisation and rely on the kernel to provide random source ports]))
+AC_ARG_ENABLE(explicit-port-randomisation, AS_HELP_STRING([--disable-explicit-port-randomisation],[disable explicit source port randomisation and rely on the kernel to provide random source ports]))
 case "$enable_explicit_port_randomisation" in
 	no)
 		AC_DEFINE([DISABLE_EXPLICIT_PORT_RANDOMISATION], [1], [Define this to enable kernel based UDP source port randomization.])
@@ -1909,8 +1880,7 @@ AC_SUBST(SOURCEFILE)
 # see if we want to build the library or everything
 ALLTARGET="alltargets"
 INSTALLTARGET="install-all"
-AC_ARG_WITH(libunbound-only, AC_HELP_STRING([--with-libunbound-only],
-	[do not build daemon and tool programs]),
+AC_ARG_WITH(libunbound-only, AS_HELP_STRING([--with-libunbound-only],[do not build daemon and tool programs]),
 	[
 	if test "$withval" = "yes"; then
 		ALLTARGET="lib"
@@ -1919,10 +1889,10 @@ AC_ARG_WITH(libunbound-only, AC_HELP_STRING([--with-libunbound-only],
 ])
 if test $ALLTARGET = "alltargets"; then
 	if test $USE_NSS = "yes"; then 
-		AC_ERROR([--with-nss can only be used in combination with --with-libunbound-only.])	
+		AC_MSG_ERROR([--with-nss can only be used in combination with --with-libunbound-only.])	
 	fi
 	if test $USE_NETTLE = "yes"; then
-		AC_ERROR([--with-nettle can only be used in combination with --with-libunbound-only.])	
+		AC_MSG_ERROR([--with-nettle can only be used in combination with --with-libunbound-only.])	
 	fi
 fi
 
@@ -2199,5 +2169,5 @@ AC_SUBST(version, [VERSION_MAJOR.VERSION_MINOR.VERSION_MICRO])
 AC_SUBST(date, [`date +'%b %e, %Y'`])
 
 AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service contrib/unbound_portable.service])
-AC_CONFIG_HEADER([config.h])
+AC_CONFIG_HEADERS([config.h])
 AC_OUTPUT
diff --git a/dnscrypt/dnscrypt.m4 b/dnscrypt/dnscrypt.m4
index 591bd1375..68964242a 100644
--- a/dnscrypt/dnscrypt.m4
+++ b/dnscrypt/dnscrypt.m4
@@ -11,7 +11,7 @@ AC_DEFUN([dnsc_DNSCRYPT],
     [opt_dnscrypt=$enableval], [opt_dnscrypt=no])
 
   if test "x$opt_dnscrypt" != "xno"; then
-    AC_ARG_WITH([libsodium], AC_HELP_STRING([--with-libsodium=path],
+    AC_ARG_WITH([libsodium], AS_HELP_STRING([--with-libsodium=path],
     	[Path where libsodium is installed, for dnscrypt]), [
 	CFLAGS="$CFLAGS -I$withval/include"
 	LDFLAGS="$LDFLAGS -L$withval/lib"
diff --git a/dnstap/dnstap.m4 b/dnstap/dnstap.m4
index ba723e0be..1ff6c3fea 100644
--- a/dnstap/dnstap.m4
+++ b/dnstap/dnstap.m4
@@ -20,7 +20,7 @@ AC_DEFUN([dt_DNSTAP],
     if test -z "$PROTOC_C"; then
       AC_MSG_ERROR([The protoc-c program was not found. Please install protobuf-c!])
     fi
-    AC_ARG_WITH([protobuf-c], AC_HELP_STRING([--with-protobuf-c=path],
+    AC_ARG_WITH([protobuf-c], AS_HELP_STRING([--with-protobuf-c=path],
     	[Path where protobuf-c is installed, for dnstap]), [
 	  # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
 	  if test -f $withval/include/google/protobuf-c/protobuf-c.h; then
diff --git a/doc/Changelog b/doc/Changelog
index 093a4b8aa..f48fe64c0 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+5 January 2021: Wouter
+	- Fix #385: autoconf 2.70 impacts unbound build
+
 4 January 2021: Wouter
 	- For #376: Fix that comm point event is not double removed or double
 	  added to event map.

From b788e292656c66d8a8ba9e5be793acd84c1e8881 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Tue, 5 Jan 2021 12:48:27 +0100
Subject: [PATCH 21/44] Fix acx_nlnetlabs.m4 for aclocal

---
 acx_nlnetlabs.m4 | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/acx_nlnetlabs.m4 b/acx_nlnetlabs.m4
index 2b7768075..d33352f17 100644
--- a/acx_nlnetlabs.m4
+++ b/acx_nlnetlabs.m4
@@ -2,7 +2,8 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 36
+# Version 37
+# 2021-01-05 fix defun for aclocal
 # 2021-01-05 autoconf 2.70 autoupdate and fixes, no AC_TRY_COMPILE
 # 2020-08-24 Use EVP_sha256 instead of HMAC_Update (for openssl-3.0.0).
 # 2016-03-21 Check -ldl -pthread for libcrypto for ldns and openssl 1.1.0.
@@ -519,8 +520,8 @@ AC_DEFUN([AC_PROG_CXX], [:])
 AC_DEFUN([AC_PROG_CXXCPP], [:])
 AC_DEFUN([AC_PROG_OBJC], [:])
 AC_DEFUN([AC_PROG_OBJCCPP], [:])
-AC_DEFUN([LT_LANG([C++])], [:])
-AC_DEFUN([LT_LANG([Fortran 77])], [:])
+AC_DEFUN([AC_LIBTOOL_CXX], [:])
+AC_DEFUN([AC_LIBTOOL_F77], [:])
 # always use ./libtool unless override from commandline (libtool=mylibtool)
 if test -z "$libtool"; then
 	libtool="./libtool"

From c357e0fea46028225c9caec5494479f472741c36 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Tue, 5 Jan 2021 13:43:53 +0100
Subject: [PATCH 22/44] Changelog note for #375 and -h output. - Merge PR #375
 by fhriley: Add rpz_enable and rpz_disable commands   to unbound-control.

---
 doc/Changelog              | 2 ++
 smallapp/unbound-control.c | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/doc/Changelog b/doc/Changelog
index f48fe64c0..a596befee 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,5 +1,7 @@
 5 January 2021: Wouter
 	- Fix #385: autoconf 2.70 impacts unbound build
+	- Merge PR #375 by fhriley: Add rpz_enable and rpz_disable commands
+	  to unbound-control.
 
 4 January 2021: Wouter
 	- For #376: Fix that comm point event is not double removed or double
diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
index 93281736a..d58f1b2f9 100644
--- a/smallapp/unbound-control.c
+++ b/smallapp/unbound-control.c
@@ -167,6 +167,9 @@ usage(void)
 	printf("  view_local_data_remove view name  	remove local-data in view\n");
 	printf("  view_local_datas_remove view 		remove list of local-data from view\n");
 	printf("  					one entry per line read from stdin\n");
+	printf("  rpz_enable zone		Enable the RPZ zone if it had previously\n");
+	printf("  				been disabled\n");
+	printf("  rpz_disable zone		Disable the RPZ zone\n");
 	printf("Version %s\n", PACKAGE_VERSION);
 	printf("BSD licensed, see LICENSE in source package for details.\n");
 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);

From 44075a06a5c716fe44d5c9756bc17a6f808a8748 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Wed, 6 Jan 2021 10:36:23 +0100
Subject: [PATCH 23/44] - Fix #379: zone loading over HTTP appears to have
 buffer issues.

---
 doc/Changelog   | 3 +++
 util/netevent.c | 8 +++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/doc/Changelog b/doc/Changelog
index a596befee..b450e75e2 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+6 January 2021: Wouter
+	- Fix #379: zone loading over HTTP appears to have buffer issues.
+
 5 January 2021: Wouter
 	- Fix #385: autoconf 2.70 impacts unbound build
 	- Merge PR #375 by fhriley: Add rpz_enable and rpz_disable commands
diff --git a/util/netevent.c b/util/netevent.c
index 5c7550805..a5c3fe666 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -2412,7 +2412,7 @@ http_nonchunk_segment(struct comm_point* c)
 	return 1;
 }
 
-/** handle nonchunked data segment, return 0=fail, 1=wait, 2=process more */
+/** handle chunked data segment, return 0=fail, 1=wait, 2=process more */
 static int
 http_chunked_segment(struct comm_point* c)
 {
@@ -2422,6 +2422,7 @@ http_chunked_segment(struct comm_point* c)
 	 */
 	size_t remainbufferlen;
 	size_t got_now = sldns_buffer_limit(c->buffer) - c->http_stored;
+	verbose(VERB_ALGO, "http_chunked_segment: got now %d, tcpbytcount %d, http_stored %d, buffer pos %d, buffer limit %d", (int)got_now, (int)c->tcp_byte_count, (int)c->http_stored, (int)sldns_buffer_position(c->buffer), (int)sldns_buffer_limit(c->buffer));
 	if(c->tcp_byte_count <= got_now) {
 		/* the chunk has completed (with perhaps some extra data
 		 * from next chunk header and next chunk) */
@@ -2761,6 +2762,11 @@ comm_point_http_handle_read(int fd, struct comm_point* c)
 	}
 
 	sldns_buffer_flip(c->buffer);
+	/* if we are partway in a segment of data, position us at the point
+	 * where we left off previously */
+	if(c->http_stored < sldns_buffer_limit(c->buffer))
+		sldns_buffer_set_position(c->buffer, c->http_stored);
+	else	sldns_buffer_set_position(c->buffer, sldns_buffer_limit(c->buffer));
 
 	while(sldns_buffer_remaining(c->buffer) > 0) {
 		/* Handle HTTP/1.x data */

From 422213c1719ca324faced1b4c6210a36b4c7506a Mon Sep 17 00:00:00 2001
From: Anton Lindqvist <anton@basename.se>
Date: Wed, 6 Jan 2021 12:35:22 +0100
Subject: [PATCH 24/44] add missing null check

I have a unbound forward zone configured on my router for my $DAYJOB.
The address associated with the zone is only accessible when the router
is connected to a VPN. If the VPN connection is absent, trying to
resolve any domain that must be handled by the zone crashes unbound.
Turns out there's a missing NULL check in `comm_point_send_udp_msg()`.
The same routine already has `if (addr) {} else {}` branches so I guess
protecting the call to `log_addr()` using the same conditional is
reasonable

I have also committed the same fix to unbound shipped with OpenBSD[1].

[1] https://marc.info/?l=openbsd-cvs&m=160993335615698&w=2
---
 util/netevent.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/util/netevent.c b/util/netevent.c
index a5c3fe666..a2c0e6073 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -388,8 +388,9 @@ comm_point_send_udp_msg(struct comm_point *c, sldns_buffer* packet,
 		} else {
 			verbose(VERB_OPS, "send failed: %s", sock_strerror(errno));
 		}
-		log_addr(VERB_OPS, "remote address is",
-			(struct sockaddr_storage*)addr, addrlen);
+		if(addr)
+			log_addr(VERB_OPS, "remote address is",
+				(struct sockaddr_storage*)addr, addrlen);
 		return 0;
 	} else if((size_t)sent != sldns_buffer_remaining(packet)) {
 		log_err("sent %d in place of %d bytes", 

From 752aea84073f865d17cb6ed85d0fa5b6488a2c24 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Wed, 6 Jan 2021 13:19:46 +0100
Subject: [PATCH 25/44] Changelog note for #395 - Merge PR #395 from mptre: add
 missing null check.

---
 doc/Changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/Changelog b/doc/Changelog
index b450e75e2..6c1e9a20e 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,5 +1,6 @@
 6 January 2021: Wouter
 	- Fix #379: zone loading over HTTP appears to have buffer issues.
+	- Merge PR #395 from mptre: add missing null check.
 
 5 January 2021: Wouter
 	- Fix #385: autoconf 2.70 impacts unbound build

From 2e4d64684e0bc6352d469650689c14690218bf57 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Wed, 6 Jan 2021 13:42:00 +0100
Subject: [PATCH 26/44] - Fix #387: client-subnet-always-forward seems to
 effectively bypass   any caching?

---
 doc/Changelog         | 2 ++
 doc/unbound.conf.5.in | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/doc/Changelog b/doc/Changelog
index 6c1e9a20e..7e8313333 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,8 @@
 6 January 2021: Wouter
 	- Fix #379: zone loading over HTTP appears to have buffer issues.
 	- Merge PR #395 from mptre: add missing null check.
+	- Fix #387: client-subnet-always-forward seems to effectively bypass
+	  any caching?
 
 5 January 2021: Wouter
 	- Fix #385: autoconf 2.70 impacts unbound build
diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 38bbc44df..fa6f91b7c 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -2033,7 +2033,8 @@ Specify whether the ECS address check (configured using
 query contains an ECS record, or only for queries for which the ECS record is
 generated using the querier address (and therefore did not contain ECS data in
 the client query). If enabled, the address check is skipped when the client
-query contains an ECS record. Default is no.
+query contains an ECS record. And the lookup in the regular cache is skipped.
+Default is no.
 .TP
 .B max\-client\-subnet\-ipv6: \fI<number>\fR
 Specifies the maximum prefix length of the client source address we are willing

From 260837e05000e9f82977afd8c3887568f7c136e5 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Fri, 8 Jan 2021 09:36:37 +0100
Subject: [PATCH 27/44] Changelog note for #391 - Merge PR #391 from fhriley:
 Add start_time to reply callbacks so   modules can compute the response time.

---
 doc/Changelog | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/doc/Changelog b/doc/Changelog
index 7e8313333..fa91a09bb 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+8 January 2021: Wouter
+	- Merge PR #391 from fhriley: Add start_time to reply callbacks so
+	  modules can compute the response time.
+
 6 January 2021: Wouter
 	- Fix #379: zone loading over HTTP appears to have buffer issues.
 	- Merge PR #395 from mptre: add missing null check.

From 3e03e2c26db500dff237a426de7688f9a8277625 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Fri, 8 Jan 2021 09:47:46 +0100
Subject: [PATCH 28/44] - For #391: use struct timeval* start_time for callback
 information.

---
 daemon/worker.c                 | 14 +++++++-------
 doc/Changelog                   |  1 +
 dynlibmod/dynlibmod.c           |  2 +-
 dynlibmod/dynlibmod.h           |  2 +-
 dynlibmod/examples/helloworld.c |  4 ++--
 pythonmod/interface.i           |  4 ++--
 pythonmod/pythonmod.h           |  2 +-
 services/authzone.c             |  4 ++--
 services/localzone.c            |  4 ++--
 services/mesh.c                 | 20 ++++++++++----------
 util/data/msgreply.c            | 10 +++++-----
 util/data/msgreply.h            |  8 ++++----
 util/module.h                   |  2 +-
 13 files changed, 39 insertions(+), 38 deletions(-)

diff --git a/daemon/worker.c b/daemon/worker.c
index edf96988a..33b70e83e 100644
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -514,7 +514,7 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 			edns->bits &= EDNS_DO;
 			if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL,
 				msg->rep, LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad,
-				*worker->env.now_tv))
+				worker->env.now_tv))
 					return 0;
 			error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
 				&msg->qinfo, id, flags, edns);
@@ -546,7 +546,7 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 	edns->bits &= EDNS_DO;
 	if(!inplace_cb_reply_cache_call(&worker->env, qinfo, NULL, msg->rep,
 		(int)(flags&LDNS_RCODE_MASK), edns, repinfo, worker->scratchpad,
-        *worker->env.now_tv))
+        worker->env.now_tv))
 			return 0;
 	msg->rep->flags |= BIT_QR|BIT_RA;
 	if(!apply_edns_options(edns, &edns_bak, worker->env.cfg,
@@ -556,7 +556,7 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 		udpsize, edns, (int)(edns->bits & EDNS_DO), secure)) {
 		if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, NULL,
 			LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad,
-			*worker->env.now_tv))
+			worker->env.now_tv))
 				edns->opt_list = NULL;
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
 			&msg->qinfo, id, flags, edns);
@@ -688,7 +688,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 		edns->bits &= EDNS_DO;
 		if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, rep,
 			LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad,
-           *worker->env.now_tv))
+           worker->env.now_tv))
 			goto bail_out;
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL,
 			qinfo, id, flags, edns);
@@ -723,7 +723,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	edns->bits &= EDNS_DO;
 	if(!inplace_cb_reply_cache_call(&worker->env, qinfo, NULL, rep,
 		(int)(flags&LDNS_RCODE_MASK), edns, repinfo, worker->scratchpad,
-		*worker->env.now_tv))
+		worker->env.now_tv))
 		goto bail_out;
 	*alias_rrset = NULL; /* avoid confusion if caller set it to non-NULL */
 	if((worker->daemon->use_response_ip || worker->daemon->use_rpz) &&
@@ -760,7 +760,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 		udpsize, edns, (int)(edns->bits & EDNS_DO), *is_secure_answer)) {
 		if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, NULL,
 			LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad,
-           *worker->env.now_tv))
+           worker->env.now_tv))
 				edns->opt_list = NULL;
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
 			qinfo, id, flags, edns);
@@ -849,7 +849,7 @@ chaos_replystr(sldns_buffer* pkt, char** str, int num, struct edns_data* edns,
 	edns->bits &= EDNS_DO;
 	if(!inplace_cb_reply_local_call(&worker->env, NULL, NULL, NULL,
 		LDNS_RCODE_NOERROR, edns, repinfo, worker->scratchpad,
-        *worker->env.now_tv))
+        worker->env.now_tv))
 			edns->opt_list = NULL;
 	if(sldns_buffer_capacity(pkt) >=
 		sldns_buffer_limit(pkt)+calc_edns_field_size(edns))
diff --git a/doc/Changelog b/doc/Changelog
index fa91a09bb..e8da85d6a 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,7 @@
 8 January 2021: Wouter
 	- Merge PR #391 from fhriley: Add start_time to reply callbacks so
 	  modules can compute the response time.
+	- For #391: use struct timeval* start_time for callback information.
 
 6 January 2021: Wouter
 	- Fix #379: zone loading over HTTP appears to have buffer issues.
diff --git a/dynlibmod/dynlibmod.c b/dynlibmod/dynlibmod.c
index e842c9d8a..ffac7ff30 100644
--- a/dynlibmod/dynlibmod.c
+++ b/dynlibmod/dynlibmod.c
@@ -213,7 +213,7 @@ int dynlib_inplace_cb_reply_generic(struct query_info* qinfo,
     struct module_qstate* qstate, struct reply_info* rep, int rcode,
     struct edns_data* edns, struct edns_option** opt_list_out,
     struct comm_reply* repinfo, struct regional* region,
-    struct timeval start_time, int id, void* callback) {
+    struct timeval* start_time, int id, void* callback) {
     struct cb_pair* cb_pair = (struct cb_pair*) callback;
     return ((inplace_cb_reply_func_type*) cb_pair->cb)(qinfo, qstate, rep, rcode, edns, opt_list_out, repinfo, region, start_time, id, cb_pair->cb_arg);
 }
diff --git a/dynlibmod/dynlibmod.h b/dynlibmod/dynlibmod.h
index f35dafa1a..321f4f693 100644
--- a/dynlibmod/dynlibmod.h
+++ b/dynlibmod/dynlibmod.h
@@ -71,7 +71,7 @@ int dynlib_inplace_cb_reply_generic(struct query_info* qinfo,
     struct module_qstate* qstate, struct reply_info* rep, int rcode,
     struct edns_data* edns, struct edns_option** opt_list_out,
     struct comm_reply* repinfo, struct regional* region,
-	struct timeval start_time, int id, void* callback);
+	struct timeval* start_time, int id, void* callback);
 
 int dynlib_inplace_cb_query_generic(struct query_info* qinfo, uint16_t flags,
     struct module_qstate* qstate, struct sockaddr_storage* addr,
diff --git a/dynlibmod/examples/helloworld.c b/dynlibmod/examples/helloworld.c
index 5ea9c51be..7da32d9bb 100644
--- a/dynlibmod/examples/helloworld.c
+++ b/dynlibmod/examples/helloworld.c
@@ -31,7 +31,7 @@ int reply_callback(struct query_info* qinfo,
     struct module_qstate* qstate, struct reply_info* rep, int rcode,
     struct edns_data* edns, struct edns_option** opt_list_out,
     struct comm_reply* repinfo, struct regional* region,
-    struct timeval start_time, int id, void* callback);
+    struct timeval* start_time, int id, void* callback);
 
 /* Init is called when the module is first loaded. It should be used to set up
  * the environment for this module and do any other initialisation required. */
@@ -117,7 +117,7 @@ int reply_callback(struct query_info* qinfo,
     struct module_qstate* qstate, struct reply_info* rep, int rcode,
     struct edns_data* edns, struct edns_option** opt_list_out,
     struct comm_reply* repinfo, struct regional* region,
-    struct timeval start_time, int id, void* callback) {
+    struct timeval* start_time, int id, void* callback) {
     log_info("dynlib: hello world from callback");
     struct dynlibmod_env* env = qstate->env->modinfo[id];
     if (env->dyn_env != NULL) {
diff --git a/pythonmod/interface.i b/pythonmod/interface.i
index 8f44e52b6..6e629fa70 100644
--- a/pythonmod/interface.i
+++ b/pythonmod/interface.i
@@ -1542,13 +1542,13 @@ int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len,
         struct module_qstate* qstate, struct reply_info* rep, int rcode,
         struct edns_data* edns, struct edns_option** opt_list_out,
         struct comm_reply* repinfo, struct regional* region,
-        struct timeval start_time, int id, void* python_callback)
+        struct timeval* start_time, int id, void* python_callback)
     {
         PyObject *func, *py_edns, *py_qstate, *py_opt_list_out, *py_qinfo;
         PyObject *py_rep, *py_repinfo, *py_region;
         PyObject *py_args, *py_kwargs, *result;
         int res = 0;
-        double py_start_time = start_time.tv_sec + start_time.tv_usec / 1e6;
+        double py_start_time = start_time->tv_sec + start_time->tv_usec / 1e6;
 
         PyGILState_STATE gstate = PyGILState_Ensure();
         func = (PyObject *) python_callback;
diff --git a/pythonmod/pythonmod.h b/pythonmod/pythonmod.h
index 222ebd71e..f5ae9ca56 100644
--- a/pythonmod/pythonmod.h
+++ b/pythonmod/pythonmod.h
@@ -73,7 +73,7 @@ int python_inplace_cb_reply_generic(struct query_info* qinfo,
 	struct module_qstate* qstate, struct reply_info* rep, int rcode,
 	struct edns_data* edns, struct edns_option** opt_list_out,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval start_time, int id, void* python_callback);
+    struct timeval* start_time, int id, void* python_callback);
 
 /** Declared here for fptr_wlist access. The definition is in interface.i. */
 int python_inplace_cb_query_generic(
diff --git a/services/authzone.c b/services/authzone.c
index 0f6d691a2..3ad38865e 100644
--- a/services/authzone.c
+++ b/services/authzone.c
@@ -3286,7 +3286,7 @@ auth_answer_encode(struct query_info* qinfo, struct module_env* env,
 	edns->bits &= EDNS_DO;
 
 	if(!inplace_cb_reply_local_call(env, qinfo, NULL, msg->rep,
-		(int)FLAGS_GET_RCODE(msg->rep->flags), edns, repinfo, temp, *env->now_tv)
+		(int)FLAGS_GET_RCODE(msg->rep->flags), edns, repinfo, temp, env->now_tv)
 		|| !reply_info_answer_encode(qinfo, msg->rep,
 		*(uint16_t*)sldns_buffer_begin(buf),
 		sldns_buffer_read_u16_at(buf, 2),
@@ -3310,7 +3310,7 @@ auth_error_encode(struct query_info* qinfo, struct module_env* env,
 	edns->bits &= EDNS_DO;
 
 	if(!inplace_cb_reply_local_call(env, qinfo, NULL, NULL,
-		rcode, edns, repinfo, temp, *env->now_tv))
+		rcode, edns, repinfo, temp, env->now_tv))
 		edns->opt_list = NULL;
 	error_encode(buf, rcode|BIT_AA, qinfo,
 		*(uint16_t*)sldns_buffer_begin(buf),
diff --git a/services/localzone.c b/services/localzone.c
index 308150a00..c7ae95888 100644
--- a/services/localzone.c
+++ b/services/localzone.c
@@ -1215,7 +1215,7 @@ local_encode(struct query_info* qinfo, struct module_env* env,
 	edns->ext_rcode = 0;
 	edns->bits &= EDNS_DO;
 	if(!inplace_cb_reply_local_call(env, qinfo, NULL, &rep, rcode, edns,
-		repinfo, temp, *env->now_tv) || !reply_info_answer_encode(qinfo, &rep,
+		repinfo, temp, env->now_tv) || !reply_info_answer_encode(qinfo, &rep,
 		*(uint16_t*)sldns_buffer_begin(buf), sldns_buffer_read_u16_at(buf, 2),
 		buf, 0, 0, temp, udpsize, edns, (int)(edns->bits&EDNS_DO), 0)) {
 		error_encode(buf, (LDNS_RCODE_SERVFAIL|BIT_AA), qinfo,
@@ -1237,7 +1237,7 @@ local_error_encode(struct query_info* qinfo, struct module_env* env,
 	edns->bits &= EDNS_DO;
 
 	if(!inplace_cb_reply_local_call(env, qinfo, NULL, NULL,
-		rcode, edns, repinfo, temp, *env->now_tv))
+		rcode, edns, repinfo, temp, env->now_tv))
 		edns->opt_list = NULL;
 	error_encode(buf, r, qinfo, *(uint16_t*)sldns_buffer_begin(buf),
 		sldns_buffer_read_u16_at(buf, 2), edns);
diff --git a/services/mesh.c b/services/mesh.c
index de481c0d5..4c806dc4b 100644
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -498,7 +498,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 		if(!s) {
 			log_err("mesh_state_create: out of memory; SERVFAIL");
 			if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL, NULL,
-				LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, *s->s.env->now_tv))
+				LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, s->s.env->now_tv))
 					edns->opt_list = NULL;
 			error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
 				qinfo, qid, qflags, edns);
@@ -514,7 +514,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 			if(!s->s.edns_opts_front_in) {
 				log_err("mesh_state_create: out of memory; SERVFAIL");
 				if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL,
-					NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, *s->s.env->now_tv))
+					NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, s->s.env->now_tv))
 						edns->opt_list = NULL;
 				error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
 					qinfo, qid, qflags, edns);
@@ -587,7 +587,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 
 servfail_mem:
 	if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, &s->s,
-		NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, *s->s.env->now_tv))
+		NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, s->s.env->now_tv))
 			edns->opt_list = NULL;
 	error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
 		qinfo, qid, qflags, edns);
@@ -1115,7 +1115,7 @@ int mesh_state_attachment(struct mesh_state* super, struct mesh_state* sub)
  */
 static void
 mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
-	struct mesh_cb* r, struct timeval start_time)
+	struct mesh_cb* r, struct timeval* start_time)
 {
 	int secure;
 	char* reason = NULL;
@@ -1256,11 +1256,11 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 		m->s.qinfo.local_alias = r->local_alias;
 		if(rcode == LDNS_RCODE_SERVFAIL) {
 			if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
-				rep, rcode, &r->edns, &r->query_reply, m->s.region, r->start_time))
+				rep, rcode, &r->edns, &r->query_reply, m->s.region, &r->start_time))
 					r->edns.opt_list = NULL;
 		} else { 
 			if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode,
-				&r->edns, &r->query_reply, m->s.region, r->start_time))
+				&r->edns, &r->query_reply, m->s.region, &r->start_time))
 					r->edns.opt_list = NULL;
 		}
 		error_encode(r_buffer, rcode, &m->s.qinfo, r->qid,
@@ -1277,7 +1277,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 		m->s.qinfo.qname = r->qname;
 		m->s.qinfo.local_alias = r->local_alias;
 		if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep,
-			LDNS_RCODE_NOERROR, &r->edns, &r->query_reply, m->s.region, r->start_time) ||
+			LDNS_RCODE_NOERROR, &r->edns, &r->query_reply, m->s.region, &r->start_time) ||
 			!apply_edns_options(&r->edns, &edns_bak,
 				m->s.env->cfg, r->query_reply.c,
 				m->s.region) ||
@@ -1287,7 +1287,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 			secure)) 
 		{
 			if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
-			rep, LDNS_RCODE_SERVFAIL, &r->edns, &r->query_reply, m->s.region, r->start_time))
+			rep, LDNS_RCODE_SERVFAIL, &r->edns, &r->query_reply, m->s.region, &r->start_time))
 				r->edns.opt_list = NULL;
 			error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
 				&m->s.qinfo, r->qid, r->qflags, &r->edns);
@@ -1424,7 +1424,7 @@ void mesh_query_done(struct mesh_state* mstate)
 		if(!mstate->reply_list && !mstate->cb_list &&
 			mstate->super_set.count == 0)
 			mstate->s.env->mesh->num_detached_states++;
-		mesh_do_callback(mstate, mstate->s.return_rcode, rep, c, tv);
+		mesh_do_callback(mstate, mstate->s.return_rcode, rep, c, &tv);
 	}
 }
 
@@ -2048,6 +2048,6 @@ mesh_serve_expired_callback(void* arg)
 		if(!mstate->reply_list && !mstate->cb_list &&
 			mstate->super_set.count == 0)
 			qstate->env->mesh->num_detached_states++;
-		mesh_do_callback(mstate, LDNS_RCODE_NOERROR, msg->rep, c, tv);
+		mesh_do_callback(mstate, LDNS_RCODE_NOERROR, msg->rep, c, &tv);
 	}
 }
diff --git a/util/data/msgreply.c b/util/data/msgreply.c
index 3f7eb5fc9..a48cb78f1 100644
--- a/util/data/msgreply.c
+++ b/util/data/msgreply.c
@@ -1036,7 +1036,7 @@ static int inplace_cb_reply_call_generic(
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval start_time)
+    struct timeval* start_time)
 {
 	struct inplace_cb* cb;
 	struct edns_option* opt_list_out = NULL;
@@ -1058,7 +1058,7 @@ static int inplace_cb_reply_call_generic(
 int inplace_cb_reply_call(struct module_env* env, struct query_info* qinfo,
 	struct module_qstate* qstate, struct reply_info* rep, int rcode,
 	struct edns_data* edns, struct comm_reply* repinfo, struct regional* region,
-    struct timeval start_time)
+    struct timeval* start_time)
 {
 	return inplace_cb_reply_call_generic(
 		env->inplace_cb_lists[inplace_cb_reply], inplace_cb_reply, qinfo,
@@ -1069,7 +1069,7 @@ int inplace_cb_reply_cache_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval start_time)
+    struct timeval* start_time)
 {
 	return inplace_cb_reply_call_generic(
 		env->inplace_cb_lists[inplace_cb_reply_cache], inplace_cb_reply_cache,
@@ -1080,7 +1080,7 @@ int inplace_cb_reply_local_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval start_time)
+    struct timeval* start_time)
 {
 	return inplace_cb_reply_call_generic(
 		env->inplace_cb_lists[inplace_cb_reply_local], inplace_cb_reply_local,
@@ -1091,7 +1091,7 @@ int inplace_cb_reply_servfail_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval start_time)
+    struct timeval* start_time)
 {
 	/* We are going to servfail. Remove any potential edns options. */
 	if(qstate)
diff --git a/util/data/msgreply.h b/util/data/msgreply.h
index b7706b023..32466644f 100644
--- a/util/data/msgreply.h
+++ b/util/data/msgreply.h
@@ -559,7 +559,7 @@ struct edns_option* edns_opt_list_find(struct edns_option* list, uint16_t code);
 int inplace_cb_reply_call(struct module_env* env, struct query_info* qinfo,
 	struct module_qstate* qstate, struct reply_info* rep, int rcode,
 	struct edns_data* edns, struct comm_reply* repinfo, struct regional* region,
-    struct timeval start_time);
+    struct timeval* start_time);
 
 /**
  * Call the registered functions in the inplace_cb_reply_cache linked list.
@@ -578,7 +578,7 @@ int inplace_cb_reply_cache_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval start_time);
+    struct timeval* start_time);
 
 /**
  * Call the registered functions in the inplace_cb_reply_local linked list.
@@ -597,7 +597,7 @@ int inplace_cb_reply_local_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval start_time);
+    struct timeval* start_time);
 
 /**
  * Call the registered functions in the inplace_cb_reply linked list.
@@ -617,7 +617,7 @@ int inplace_cb_reply_servfail_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval start_time);
+    struct timeval* start_time);
 
 /**
  * Call the registered functions in the inplace_cb_query linked list.
diff --git a/util/module.h b/util/module.h
index d29b6f318..9267b49e8 100644
--- a/util/module.h
+++ b/util/module.h
@@ -258,7 +258,7 @@ typedef int inplace_cb_reply_func_type(struct query_info* qinfo,
 	struct module_qstate* qstate, struct reply_info* rep, int rcode,
 	struct edns_data* edns, struct edns_option** opt_list_out,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval start_time, int id, void* callback);
+    struct timeval* start_time, int id, void* callback);
 
 /**
  * Inplace callback function called before sending the query to a nameserver.

From ee2545d93926a8fc80ff0a0bac6df14425f32a02 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Fri, 8 Jan 2021 09:53:52 +0100
Subject: [PATCH 29/44] - For #391: fix indentation.

---
 daemon/worker.c       |  8 ++++----
 doc/Changelog         |  1 +
 pythonmod/pythonmod.h |  2 +-
 services/mesh.c       |  4 ++--
 util/data/msgreply.c  | 10 +++++-----
 util/data/msgreply.h  |  8 ++++----
 util/module.h         |  2 +-
 7 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/daemon/worker.c b/daemon/worker.c
index 33b70e83e..37a8e1fe0 100644
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -546,7 +546,7 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 	edns->bits &= EDNS_DO;
 	if(!inplace_cb_reply_cache_call(&worker->env, qinfo, NULL, msg->rep,
 		(int)(flags&LDNS_RCODE_MASK), edns, repinfo, worker->scratchpad,
-        worker->env.now_tv))
+		worker->env.now_tv))
 			return 0;
 	msg->rep->flags |= BIT_QR|BIT_RA;
 	if(!apply_edns_options(edns, &edns_bak, worker->env.cfg,
@@ -688,7 +688,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 		edns->bits &= EDNS_DO;
 		if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, rep,
 			LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad,
-           worker->env.now_tv))
+			worker->env.now_tv))
 			goto bail_out;
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL,
 			qinfo, id, flags, edns);
@@ -760,7 +760,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 		udpsize, edns, (int)(edns->bits & EDNS_DO), *is_secure_answer)) {
 		if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, NULL,
 			LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad,
-           worker->env.now_tv))
+			worker->env.now_tv))
 				edns->opt_list = NULL;
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
 			qinfo, id, flags, edns);
@@ -849,7 +849,7 @@ chaos_replystr(sldns_buffer* pkt, char** str, int num, struct edns_data* edns,
 	edns->bits &= EDNS_DO;
 	if(!inplace_cb_reply_local_call(&worker->env, NULL, NULL, NULL,
 		LDNS_RCODE_NOERROR, edns, repinfo, worker->scratchpad,
-        worker->env.now_tv))
+		worker->env.now_tv))
 			edns->opt_list = NULL;
 	if(sldns_buffer_capacity(pkt) >=
 		sldns_buffer_limit(pkt)+calc_edns_field_size(edns))
diff --git a/doc/Changelog b/doc/Changelog
index e8da85d6a..c7d09cbb6 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -2,6 +2,7 @@
 	- Merge PR #391 from fhriley: Add start_time to reply callbacks so
 	  modules can compute the response time.
 	- For #391: use struct timeval* start_time for callback information.
+	- For #391: fix indentation.
 
 6 January 2021: Wouter
 	- Fix #379: zone loading over HTTP appears to have buffer issues.
diff --git a/pythonmod/pythonmod.h b/pythonmod/pythonmod.h
index f5ae9ca56..26d74e09f 100644
--- a/pythonmod/pythonmod.h
+++ b/pythonmod/pythonmod.h
@@ -73,7 +73,7 @@ int python_inplace_cb_reply_generic(struct query_info* qinfo,
 	struct module_qstate* qstate, struct reply_info* rep, int rcode,
 	struct edns_data* edns, struct edns_option** opt_list_out,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval* start_time, int id, void* python_callback);
+	struct timeval* start_time, int id, void* python_callback);
 
 /** Declared here for fptr_wlist access. The definition is in interface.i. */
 int python_inplace_cb_query_generic(
diff --git a/services/mesh.c b/services/mesh.c
index 4c806dc4b..270ffb8ba 100644
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -1350,7 +1350,7 @@ void mesh_query_done(struct mesh_state* mstate)
 		}
 	}
 	for(r = mstate->reply_list; r; r = r->next) {
-	    tv = r->start_time;
+		tv = r->start_time;
 
 		/* if a response-ip address block has been stored the
 		 *  information should be logged for each client. */
@@ -1992,7 +1992,7 @@ mesh_serve_expired_callback(void* arg)
 		log_dns_msg("Serve expired lookup", &qstate->qinfo, msg->rep);
 
 	for(r = mstate->reply_list; r; r = r->next) {
-	    tv = r->start_time;
+		tv = r->start_time;
 
 		/* If address info is returned, it means the action should be an
 		* 'inform' variant and the information should be logged. */
diff --git a/util/data/msgreply.c b/util/data/msgreply.c
index a48cb78f1..35cd8b93e 100644
--- a/util/data/msgreply.c
+++ b/util/data/msgreply.c
@@ -1036,7 +1036,7 @@ static int inplace_cb_reply_call_generic(
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval* start_time)
+	struct timeval* start_time)
 {
 	struct inplace_cb* cb;
 	struct edns_option* opt_list_out = NULL;
@@ -1058,7 +1058,7 @@ static int inplace_cb_reply_call_generic(
 int inplace_cb_reply_call(struct module_env* env, struct query_info* qinfo,
 	struct module_qstate* qstate, struct reply_info* rep, int rcode,
 	struct edns_data* edns, struct comm_reply* repinfo, struct regional* region,
-    struct timeval* start_time)
+	struct timeval* start_time)
 {
 	return inplace_cb_reply_call_generic(
 		env->inplace_cb_lists[inplace_cb_reply], inplace_cb_reply, qinfo,
@@ -1069,7 +1069,7 @@ int inplace_cb_reply_cache_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval* start_time)
+	struct timeval* start_time)
 {
 	return inplace_cb_reply_call_generic(
 		env->inplace_cb_lists[inplace_cb_reply_cache], inplace_cb_reply_cache,
@@ -1080,7 +1080,7 @@ int inplace_cb_reply_local_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval* start_time)
+	struct timeval* start_time)
 {
 	return inplace_cb_reply_call_generic(
 		env->inplace_cb_lists[inplace_cb_reply_local], inplace_cb_reply_local,
@@ -1091,7 +1091,7 @@ int inplace_cb_reply_servfail_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval* start_time)
+	struct timeval* start_time)
 {
 	/* We are going to servfail. Remove any potential edns options. */
 	if(qstate)
diff --git a/util/data/msgreply.h b/util/data/msgreply.h
index 32466644f..76b75ea8a 100644
--- a/util/data/msgreply.h
+++ b/util/data/msgreply.h
@@ -559,7 +559,7 @@ struct edns_option* edns_opt_list_find(struct edns_option* list, uint16_t code);
 int inplace_cb_reply_call(struct module_env* env, struct query_info* qinfo,
 	struct module_qstate* qstate, struct reply_info* rep, int rcode,
 	struct edns_data* edns, struct comm_reply* repinfo, struct regional* region,
-    struct timeval* start_time);
+	struct timeval* start_time);
 
 /**
  * Call the registered functions in the inplace_cb_reply_cache linked list.
@@ -578,7 +578,7 @@ int inplace_cb_reply_cache_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval* start_time);
+	struct timeval* start_time);
 
 /**
  * Call the registered functions in the inplace_cb_reply_local linked list.
@@ -597,7 +597,7 @@ int inplace_cb_reply_local_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval* start_time);
+	struct timeval* start_time);
 
 /**
  * Call the registered functions in the inplace_cb_reply linked list.
@@ -617,7 +617,7 @@ int inplace_cb_reply_servfail_call(struct module_env* env,
 	struct query_info* qinfo, struct module_qstate* qstate,
 	struct reply_info* rep, int rcode, struct edns_data* edns,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval* start_time);
+	struct timeval* start_time);
 
 /**
  * Call the registered functions in the inplace_cb_query linked list.
diff --git a/util/module.h b/util/module.h
index 9267b49e8..81a31a9cc 100644
--- a/util/module.h
+++ b/util/module.h
@@ -258,7 +258,7 @@ typedef int inplace_cb_reply_func_type(struct query_info* qinfo,
 	struct module_qstate* qstate, struct reply_info* rep, int rcode,
 	struct edns_data* edns, struct edns_option** opt_list_out,
 	struct comm_reply* repinfo, struct regional* region,
-    struct timeval* start_time, int id, void* callback);
+	struct timeval* start_time, int id, void* callback);
 
 /**
  * Inplace callback function called before sending the query to a nameserver.

From 1aa7168c6a7f107892c82dc94d7aee3a84316e5b Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Fri, 8 Jan 2021 09:55:55 +0100
Subject: [PATCH 30/44] - For #391: more double casts in python start time
 calculation.

---
 doc/Changelog         | 1 +
 pythonmod/interface.i | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/Changelog b/doc/Changelog
index c7d09cbb6..f5861eb98 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -3,6 +3,7 @@
 	  modules can compute the response time.
 	- For #391: use struct timeval* start_time for callback information.
 	- For #391: fix indentation.
+	- For #391: more double casts in python start time calculation.
 
 6 January 2021: Wouter
 	- Fix #379: zone loading over HTTP appears to have buffer issues.
diff --git a/pythonmod/interface.i b/pythonmod/interface.i
index 6e629fa70..5dae04aa4 100644
--- a/pythonmod/interface.i
+++ b/pythonmod/interface.i
@@ -1548,7 +1548,7 @@ int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len,
         PyObject *py_rep, *py_repinfo, *py_region;
         PyObject *py_args, *py_kwargs, *result;
         int res = 0;
-        double py_start_time = start_time->tv_sec + start_time->tv_usec / 1e6;
+        double py_start_time = ((double)start_time->tv_sec) + ((double)start_time->tv_usec) / 1.0e6;
 
         PyGILState_STATE gstate = PyGILState_Ensure();
         func = (PyObject *) python_callback;

From d9dd7bc36f4e5b79e5966e51dffb7d9e26217709 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Fri, 8 Jan 2021 11:01:06 +0100
Subject: [PATCH 31/44] - Add comment documentation.

---
 doc/Changelog        | 1 +
 services/mesh.c      | 2 ++
 util/data/msgreply.h | 8 ++++++++
 3 files changed, 11 insertions(+)

diff --git a/doc/Changelog b/doc/Changelog
index f5861eb98..9f4f41265 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -4,6 +4,7 @@
 	- For #391: use struct timeval* start_time for callback information.
 	- For #391: fix indentation.
 	- For #391: more double casts in python start time calculation.
+	- Add comment documentation.
 
 6 January 2021: Wouter
 	- Fix #379: zone loading over HTTP appears to have buffer issues.
diff --git a/services/mesh.c b/services/mesh.c
index 270ffb8ba..27de47eef 100644
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -1112,6 +1112,8 @@ int mesh_state_attachment(struct mesh_state* super, struct mesh_state* sub)
  * @param rcode: if not 0, error code.
  * @param rep: reply to send (or NULL if rcode is set).
  * @param r: callback entry
+ * @param start_time: the time to pass to callback functions, it is 0 or
+ * 	a value from one of the packets if the mesh state had packets.
  */
 static void
 mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
diff --git a/util/data/msgreply.h b/util/data/msgreply.h
index 76b75ea8a..c6b220ed8 100644
--- a/util/data/msgreply.h
+++ b/util/data/msgreply.h
@@ -554,6 +554,8 @@ struct edns_option* edns_opt_list_find(struct edns_option* list, uint16_t code);
  * @param edns: edns data of the reply.
  * @param repinfo: comm_reply. Reply information for a communication point.
  * @param region: region to store data.
+ * @param start_time: the start time of recursion, when the packet arrived,
+ * 	or the current time for cache responses.
  * @return false on failure (a callback function returned an error).
  */
 int inplace_cb_reply_call(struct module_env* env, struct query_info* qinfo,
@@ -572,6 +574,8 @@ int inplace_cb_reply_call(struct module_env* env, struct query_info* qinfo,
  * @param edns: edns data of the reply. Edns input can be found here.
  * @param repinfo: comm_reply. Reply information for a communication point.
  * @param region: region to store data.
+ * @param start_time: the start time of recursion, when the packet arrived,
+ * 	or the current time for cache responses.
  * @return false on failure (a callback function returned an error).
  */
 int inplace_cb_reply_cache_call(struct module_env* env,
@@ -591,6 +595,8 @@ int inplace_cb_reply_cache_call(struct module_env* env,
  * @param edns: edns data of the reply. Edns input can be found here.
  * @param repinfo: comm_reply. Reply information for a communication point.
  * @param region: region to store data.
+ * @param start_time: the start time of recursion, when the packet arrived,
+ * 	or the current time for cache responses.
  * @return false on failure (a callback function returned an error).
  */
 int inplace_cb_reply_local_call(struct module_env* env,
@@ -611,6 +617,8 @@ int inplace_cb_reply_local_call(struct module_env* env,
  *	is NULL.
  * @param repinfo: comm_reply. Reply information for a communication point.
  * @param region: region to store data.
+ * @param start_time: the start time of recursion, when the packet arrived,
+ * 	or the current time for cache responses.
  * @return false on failure (a callback function returned an error).
  */
 int inplace_cb_reply_servfail_call(struct module_env* env,

From 64f508fa00c8f456a89293b981496a62efd63689 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Fri, 8 Jan 2021 11:10:05 +0100
Subject: [PATCH 32/44] - Fix clang analysis warning.

---
 doc/Changelog   | 1 +
 services/mesh.c | 6 +++---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/doc/Changelog b/doc/Changelog
index 9f4f41265..58a5bf69e 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -5,6 +5,7 @@
 	- For #391: fix indentation.
 	- For #391: more double casts in python start time calculation.
 	- Add comment documentation.
+	- Fix clang analysis warning.
 
 6 January 2021: Wouter
 	- Fix #379: zone loading over HTTP appears to have buffer issues.
diff --git a/services/mesh.c b/services/mesh.c
index 27de47eef..69f4d75e3 100644
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -498,7 +498,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 		if(!s) {
 			log_err("mesh_state_create: out of memory; SERVFAIL");
 			if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL, NULL,
-				LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, s->s.env->now_tv))
+				LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv))
 					edns->opt_list = NULL;
 			error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
 				qinfo, qid, qflags, edns);
@@ -514,7 +514,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 			if(!s->s.edns_opts_front_in) {
 				log_err("mesh_state_create: out of memory; SERVFAIL");
 				if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL,
-					NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, s->s.env->now_tv))
+					NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv))
 						edns->opt_list = NULL;
 				error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
 					qinfo, qid, qflags, edns);
@@ -587,7 +587,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 
 servfail_mem:
 	if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, &s->s,
-		NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, s->s.env->now_tv))
+		NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv))
 			edns->opt_list = NULL;
 	error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
 		qinfo, qid, qflags, edns);

From 3322f631e5927c5d3adb66da05f867c64bdcb9c9 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Tue, 12 Jan 2021 13:35:05 +0100
Subject: [PATCH 33/44] - Fix #397: [Feature request] add new type always_null
 to local-zone   similar to always_nxdomain.

---
 doc/Changelog          |   4 +
 doc/example.conf.in    |   1 +
 doc/unbound.conf.5.in  |   7 +-
 services/localzone.c   |  43 ++++
 services/localzone.h   |   3 +
 testdata/localdata.rpl |  35 +++
 util/configparser.c    | 559 +++++++++++++++++++++--------------------
 util/configparser.y    |   5 +-
 8 files changed, 375 insertions(+), 282 deletions(-)

diff --git a/doc/Changelog b/doc/Changelog
index 58a5bf69e..2cd7baf00 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+12 January 2021: Wouter
+	- Fix #397: [Feature request] add new type always_null to local-zone
+	  similar to always_nxdomain.
+
 8 January 2021: Wouter
 	- Merge PR #391 from fhriley: Add start_time to reply callbacks so
 	  modules can compute the response time.
diff --git a/doc/example.conf.in b/doc/example.conf.in
index 9269461cf..c3c7c0f26 100644
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -706,6 +706,7 @@ server:
 	# o inform_redirect redirects queries and logs client IP address
 	# o always_transparent, always_refuse, always_nxdomain, resolve in
 	#   that way but ignore local data for that name
+	# o always_null returns 0.0.0.0 or ::0 for any name in the zone.
 	# o noview breaks out of that view towards global local-zones.
 	#
 	# defaults are localhost address, reverse for 127.0.0.1 and ::1
diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index fa6f91b7c..4eeb41bf9 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -1231,7 +1231,7 @@ address space are not validated.  This is usually required whenever
 Configure a local zone. The type determines the answer to give if
 there is no match from local\-data. The types are deny, refuse, static,
 transparent, redirect, nodefault, typetransparent, inform, inform_deny,
-inform_redirect, always_transparent, always_refuse, always_nxdomain, noview,
+inform_redirect, always_transparent, always_refuse, always_nxdomain, always_null, noview,
 and are explained below. After that the default settings are listed. Use
 local\-data: to enter data into the local zone. Answers for local zones
 are authoritative DNS answers. By default the zones are class IN.
@@ -1305,6 +1305,11 @@ Like refuse, but ignores local data and refuses the query.
 \h'5'\fIalways_nxdomain\fR
 Like static, but ignores local data and returns nxdomain for the query.
 .TP 10
+\h'5'\fIalways_null\fR
+Always returns 0.0.0.0 or ::0 for every name in the zone.  Like redirect
+with zero data for A and AAAA.  Ignores local data in the zone.  Used for
+some block lists.
+.TP 10
 \h'5'\fInoview\fR
 Breaks out of that view and moves towards the global local zones for answer
 to the query.  If the view first is no, it'll resolve normally.  If view first
diff --git a/services/localzone.c b/services/localzone.c
index c7ae95888..ed0d2c565 100644
--- a/services/localzone.c
+++ b/services/localzone.c
@@ -1558,6 +1558,46 @@ local_zones_zone_answer(struct local_zone* z, struct module_env* env,
 		|| lz_type == local_zone_always_transparent) {
 		/* no NODATA or NXDOMAINS for this zone type */
 		return 0;
+	} else if(lz_type == local_zone_always_null) {
+		/* 0.0.0.0 or ::0 or noerror/nodata for this zone type,
+		 * used for blocklists. */
+		if(qinfo->qtype == LDNS_RR_TYPE_A ||
+			qinfo->qtype == LDNS_RR_TYPE_AAAA) {
+			struct ub_packed_rrset_key lrr;
+			struct packed_rrset_data d;
+			time_t rr_ttl = 3600;
+			size_t rr_len = 0;
+			uint8_t rr_data[2+16] = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
+			uint8_t* rr_datas = rr_data;
+			memset(&lrr, 0, sizeof(lrr));
+			memset(&d, 0, sizeof(d));
+			lrr.entry.data = &d;
+			lrr.rk.dname = qinfo->qname;
+			lrr.rk.dname_len = qinfo->qname_len;
+			lrr.rk.type = htons(qinfo->qtype);
+			lrr.rk.rrset_class = htons(qinfo->qclass);
+			if(qinfo->qtype == LDNS_RR_TYPE_A) {
+				rr_len = 4;
+				sldns_write_uint16(rr_data, rr_len);
+				rr_len += 2;
+			} else {
+				rr_len = 16;
+				sldns_write_uint16(rr_data, rr_len);
+				rr_len += 2;
+			}
+			d.ttl = rr_ttl;
+			d.count = 1;
+			d.rr_len = &rr_len;
+			d.rr_data = &rr_datas;
+			d.rr_ttl = &rr_ttl;
+			return local_encode(qinfo, env, edns, repinfo, buf, temp,
+				&lrr, 1, LDNS_RCODE_NOERROR);
+		} else {
+			local_error_encode(qinfo, env, edns, repinfo, buf,
+				temp, LDNS_RCODE_NOERROR,
+				(LDNS_RCODE_NOERROR|BIT_AA));
+		}
+		return 1;
 	}
 	/* else lz_type == local_zone_transparent */
 
@@ -1762,6 +1802,7 @@ const char* local_zone_type2str(enum localzone_type t)
 		case local_zone_always_nxdomain: return "always_nxdomain";
 		case local_zone_always_nodata: return "always_nodata";
 		case local_zone_always_deny: return "always_deny";
+		case local_zone_always_null: return "always_null";
 		case local_zone_noview: return "noview";
 		case local_zone_invalid: return "invalid";
 	}
@@ -1798,6 +1839,8 @@ int local_zone_str2type(const char* type, enum localzone_type* t)
 		*t = local_zone_always_nodata;
 	else if(strcmp(type, "always_deny") == 0)
 		*t = local_zone_always_deny;
+	else if(strcmp(type, "always_null") == 0)
+		*t = local_zone_always_null;
 	else if(strcmp(type, "noview") == 0)
 		*t = local_zone_noview;
 	else if(strcmp(type, "nodefault") == 0)
diff --git a/services/localzone.h b/services/localzone.h
index bb3593936..492629936 100644
--- a/services/localzone.h
+++ b/services/localzone.h
@@ -96,6 +96,9 @@ enum localzone_type {
 	local_zone_always_nodata,
 	/** drop query, even when there is local data */
 	local_zone_always_deny,
+	/** answer with 0.0.0.0 or ::0 or noerror/nodata, even when there is
+	 * local data */
+	local_zone_always_null,
 	/** answer not from the view, but global or no-answer */
 	local_zone_noview,
 	/** Invalid type, cannot be used to generate answer */
diff --git a/testdata/localdata.rpl b/testdata/localdata.rpl
index a2e7eeba2..eb25ef573 100644
--- a/testdata/localdata.rpl
+++ b/testdata/localdata.rpl
@@ -35,6 +35,9 @@ server:
 	local-zone: "redirect.top." redirect
 	local-data: "redirect.top. A 20.30.40.54"
 
+	; null zone
+	local-zone: "null.top." always_null
+
 	; create implicit data in the IN domain as well
 	local-data: "a.a.implicit. A 20.30.41.50"
 	local-data: "b.a.implicit. A 20.30.42.50"
@@ -355,4 +358,36 @@ SECTION ANSWER
 www.redirect.top. IN A 20.30.40.54
 ENTRY_END
 
+; always_null zone
+STEP 60 QUERY
+ENTRY_BEGIN
+SECTION QUESTION
+null.top. IN A
+ENTRY_END
+STEP 61 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA NOERROR
+SECTION QUESTION
+null.top. IN A
+SECTION ANSWER
+null.top. IN A 0.0.0.0
+ENTRY_END
+
+; always_null zone AAAA
+STEP 62 QUERY
+ENTRY_BEGIN
+SECTION QUESTION
+foo.null.top. IN AAAA
+ENTRY_END
+STEP 63 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA AA NOERROR
+SECTION QUESTION
+foo.null.top. IN AAAA
+SECTION ANSWER
+foo.null.top. IN AAAA ::0
+ENTRY_END
+
 SCENARIO_END
diff --git a/util/configparser.c b/util/configparser.c
index 4e5bf5a41..cc5d9fb5e 100644
--- a/util/configparser.c
+++ b/util/configparser.c
@@ -1125,26 +1125,26 @@ static const yytype_uint16 yyrline[] =
     1680,  1689,  1698,  1707,  1714,  1724,  1744,  1751,  1769,  1782,
     1795,  1804,  1813,  1822,  1831,  1841,  1851,  1862,  1871,  1880,
     1889,  1898,  1907,  1916,  1929,  1942,  1951,  1958,  1967,  1976,
-    1985,  1994,  2002,  2015,  2023,  2064,  2071,  2086,  2096,  2106,
-    2113,  2120,  2127,  2136,  2144,  2158,  2179,  2200,  2212,  2224,
-    2236,  2245,  2266,  2276,  2285,  2293,  2301,  2314,  2327,  2342,
-    2357,  2366,  2375,  2381,  2390,  2399,  2409,  2419,  2432,  2445,
-    2457,  2471,  2483,  2497,  2506,  2518,  2528,  2535,  2542,  2551,
-    2560,  2570,  2580,  2590,  2597,  2604,  2613,  2622,  2632,  2642,
-    2649,  2656,  2663,  2671,  2681,  2691,  2701,  2711,  2750,  2760,
-    2768,  2776,  2791,  2800,  2805,  2806,  2807,  2807,  2807,  2808,
-    2808,  2808,  2809,  2809,  2811,  2821,  2830,  2837,  2844,  2851,
-    2858,  2865,  2872,  2877,  2878,  2879,  2879,  2879,  2880,  2880,
-    2880,  2881,  2882,  2882,  2883,  2883,  2884,  2884,  2885,  2886,
-    2887,  2888,  2889,  2890,  2892,  2901,  2911,  2918,  2925,  2934,
-    2941,  2948,  2955,  2962,  2971,  2980,  2987,  2994,  3004,  3014,
-    3024,  3034,  3044,  3054,  3059,  3060,  3061,  3063,  3069,  3074,
-    3075,  3076,  3078,  3084,  3094,  3101,  3110,  3118,  3123,  3124,
-    3126,  3126,  3126,  3127,  3127,  3128,  3129,  3130,  3131,  3132,
-    3134,  3144,  3153,  3160,  3169,  3176,  3185,  3193,  3206,  3214,
-    3227,  3232,  3233,  3234,  3234,  3235,  3235,  3235,  3236,  3238,
-    3250,  3262,  3274,  3289,  3302,  3315,  3326,  3331,  3332,  3333,
-    3333,  3335,  3350
+    1985,  1994,  2002,  2015,  2023,  2065,  2072,  2087,  2097,  2107,
+    2114,  2121,  2128,  2137,  2145,  2159,  2180,  2201,  2213,  2225,
+    2237,  2246,  2267,  2277,  2286,  2294,  2302,  2315,  2328,  2343,
+    2358,  2367,  2376,  2382,  2391,  2400,  2410,  2420,  2433,  2446,
+    2458,  2472,  2484,  2498,  2507,  2519,  2529,  2536,  2543,  2552,
+    2561,  2571,  2581,  2591,  2598,  2605,  2614,  2623,  2633,  2643,
+    2650,  2657,  2664,  2672,  2682,  2692,  2702,  2712,  2751,  2761,
+    2769,  2777,  2792,  2801,  2806,  2807,  2808,  2808,  2808,  2809,
+    2809,  2809,  2810,  2810,  2812,  2822,  2831,  2838,  2845,  2852,
+    2859,  2866,  2873,  2878,  2879,  2880,  2880,  2880,  2881,  2881,
+    2881,  2882,  2883,  2883,  2884,  2884,  2885,  2885,  2886,  2887,
+    2888,  2889,  2890,  2891,  2893,  2902,  2912,  2919,  2926,  2935,
+    2942,  2949,  2956,  2963,  2972,  2981,  2988,  2995,  3005,  3015,
+    3025,  3035,  3045,  3055,  3060,  3061,  3062,  3064,  3070,  3075,
+    3076,  3077,  3079,  3085,  3095,  3102,  3111,  3119,  3124,  3125,
+    3127,  3127,  3127,  3128,  3128,  3129,  3130,  3131,  3132,  3133,
+    3135,  3145,  3154,  3161,  3170,  3177,  3186,  3194,  3207,  3215,
+    3228,  3233,  3234,  3235,  3235,  3236,  3236,  3236,  3237,  3239,
+    3251,  3263,  3275,  3290,  3303,  3316,  3327,  3332,  3333,  3334,
+    3334,  3336,  3351
 };
 #endif
 
@@ -5019,6 +5019,7 @@ yyreduce:
 		   && strcmp((yyvsp[0].str), "always_transparent")!=0
 		   && strcmp((yyvsp[0].str), "always_refuse")!=0
 		   && strcmp((yyvsp[0].str), "always_nxdomain")!=0
+		   && strcmp((yyvsp[0].str), "always_null")!=0
 		   && strcmp((yyvsp[0].str), "noview")!=0
 		   && strcmp((yyvsp[0].str), "inform")!=0 && strcmp((yyvsp[0].str), "inform_deny")!=0
 		   && strcmp((yyvsp[0].str), "inform_redirect") != 0
@@ -5027,8 +5028,8 @@ yyreduce:
 				"refuse, redirect, transparent, "
 				"typetransparent, inform, inform_deny, "
 				"inform_redirect, always_transparent, "
-				"always_refuse, always_nxdomain, noview "
-				", nodefault or ipset");
+				"always_refuse, always_nxdomain, always_null, "
+				"noview, nodefault or ipset");
 			free((yyvsp[-1].str));
 			free((yyvsp[0].str));
 		} else if(strcmp((yyvsp[0].str), "nodefault")==0) {
@@ -5049,21 +5050,21 @@ yyreduce:
 				fatal_exit("out of memory adding local-zone");
 		}
 	}
-#line 5053 "util/configparser.c"
+#line 5054 "util/configparser.c"
     break;
 
   case 445:
-#line 2065 "./util/configparser.y"
+#line 2066 "./util/configparser.y"
     {
 		OUTYY(("P(server_local_data:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->local_data, (yyvsp[0].str)))
 			fatal_exit("out of memory adding local-data");
 	}
-#line 5063 "util/configparser.c"
+#line 5064 "util/configparser.c"
     break;
 
   case 446:
-#line 2072 "./util/configparser.y"
+#line 2073 "./util/configparser.y"
     {
 		char* ptr;
 		OUTYY(("P(server_local_data_ptr:%s)\n", (yyvsp[0].str)));
@@ -5077,11 +5078,11 @@ yyreduce:
 			yyerror("local-data-ptr could not be reversed");
 		}
 	}
-#line 5081 "util/configparser.c"
+#line 5082 "util/configparser.c"
     break;
 
   case 447:
-#line 2087 "./util/configparser.y"
+#line 2088 "./util/configparser.y"
     {
 		OUTYY(("P(server_minimal_responses:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5090,11 +5091,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5094 "util/configparser.c"
+#line 5095 "util/configparser.c"
     break;
 
   case 448:
-#line 2097 "./util/configparser.y"
+#line 2098 "./util/configparser.y"
     {
 		OUTYY(("P(server_rrset_roundrobin:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5103,41 +5104,41 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5107 "util/configparser.c"
+#line 5108 "util/configparser.c"
     break;
 
   case 449:
-#line 2107 "./util/configparser.y"
+#line 2108 "./util/configparser.y"
     {
 		OUTYY(("P(server_unknown_server_time_limit:%s)\n", (yyvsp[0].str)));
 		cfg_parser->cfg->unknown_server_time_limit = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5117 "util/configparser.c"
+#line 5118 "util/configparser.c"
     break;
 
   case 450:
-#line 2114 "./util/configparser.y"
+#line 2115 "./util/configparser.y"
     {
 		OUTYY(("P(server_max_udp_size:%s)\n", (yyvsp[0].str)));
 		cfg_parser->cfg->max_udp_size = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5127 "util/configparser.c"
+#line 5128 "util/configparser.c"
     break;
 
   case 451:
-#line 2121 "./util/configparser.y"
+#line 2122 "./util/configparser.y"
     {
 		OUTYY(("P(dns64_prefix:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dns64_prefix);
 		cfg_parser->cfg->dns64_prefix = (yyvsp[0].str);
 	}
-#line 5137 "util/configparser.c"
+#line 5138 "util/configparser.c"
     break;
 
   case 452:
-#line 2128 "./util/configparser.y"
+#line 2129 "./util/configparser.y"
     {
 		OUTYY(("P(server_dns64_synthall:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5145,22 +5146,22 @@ yyreduce:
 		else cfg_parser->cfg->dns64_synthall = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5149 "util/configparser.c"
+#line 5150 "util/configparser.c"
     break;
 
   case 453:
-#line 2137 "./util/configparser.y"
+#line 2138 "./util/configparser.y"
     {
 		OUTYY(("P(dns64_ignore_aaaa:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dns64_ignore_aaaa,
 			(yyvsp[0].str)))
 			fatal_exit("out of memory adding dns64-ignore-aaaa");
 	}
-#line 5160 "util/configparser.c"
+#line 5161 "util/configparser.c"
     break;
 
   case 454:
-#line 2145 "./util/configparser.y"
+#line 2146 "./util/configparser.y"
     {
 		char* p, *s = (yyvsp[0].str);
 		OUTYY(("P(server_define_tag:%s)\n", (yyvsp[0].str)));
@@ -5173,11 +5174,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 5177 "util/configparser.c"
+#line 5178 "util/configparser.c"
     break;
 
   case 455:
-#line 2159 "./util/configparser.y"
+#line 2160 "./util/configparser.y"
     {
 		size_t len = 0;
 		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@ -5197,11 +5198,11 @@ yyreduce:
 			}
 		}
 	}
-#line 5201 "util/configparser.c"
+#line 5202 "util/configparser.c"
     break;
 
   case 456:
-#line 2180 "./util/configparser.y"
+#line 2181 "./util/configparser.y"
     {
 		size_t len = 0;
 		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@ -5221,11 +5222,11 @@ yyreduce:
 			}
 		}
 	}
-#line 5225 "util/configparser.c"
+#line 5226 "util/configparser.c"
     break;
 
   case 457:
-#line 2201 "./util/configparser.y"
+#line 2202 "./util/configparser.y"
     {
 		OUTYY(("P(server_access_control_tag_action:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_actions,
@@ -5236,11 +5237,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		}
 	}
-#line 5240 "util/configparser.c"
+#line 5241 "util/configparser.c"
     break;
 
   case 458:
-#line 2213 "./util/configparser.y"
+#line 2214 "./util/configparser.y"
     {
 		OUTYY(("P(server_access_control_tag_data:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_datas,
@@ -5251,11 +5252,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		}
 	}
-#line 5255 "util/configparser.c"
+#line 5256 "util/configparser.c"
     break;
 
   case 459:
-#line 2225 "./util/configparser.y"
+#line 2226 "./util/configparser.y"
     {
 		OUTYY(("P(server_local_zone_override:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str3list_insert(&cfg_parser->cfg->local_zone_overrides,
@@ -5266,11 +5267,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		}
 	}
-#line 5270 "util/configparser.c"
+#line 5271 "util/configparser.c"
     break;
 
   case 460:
-#line 2237 "./util/configparser.y"
+#line 2238 "./util/configparser.y"
     {
 		OUTYY(("P(server_access_control_view:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str2list_insert(&cfg_parser->cfg->acl_view,
@@ -5278,11 +5279,11 @@ yyreduce:
 			yyerror("out of memory");
 		}
 	}
-#line 5282 "util/configparser.c"
+#line 5283 "util/configparser.c"
     break;
 
   case 461:
-#line 2246 "./util/configparser.y"
+#line 2247 "./util/configparser.y"
     {
 		size_t len = 0;
 		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@ -5302,11 +5303,11 @@ yyreduce:
 			}
 		}
 	}
-#line 5306 "util/configparser.c"
+#line 5307 "util/configparser.c"
     break;
 
   case 462:
-#line 2267 "./util/configparser.y"
+#line 2268 "./util/configparser.y"
     { 
 		OUTYY(("P(server_ip_ratelimit:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5314,11 +5315,11 @@ yyreduce:
 		else cfg_parser->cfg->ip_ratelimit = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5318 "util/configparser.c"
+#line 5319 "util/configparser.c"
     break;
 
   case 463:
-#line 2277 "./util/configparser.y"
+#line 2278 "./util/configparser.y"
     { 
 		OUTYY(("P(server_ratelimit:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5326,33 +5327,33 @@ yyreduce:
 		else cfg_parser->cfg->ratelimit = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5330 "util/configparser.c"
+#line 5331 "util/configparser.c"
     break;
 
   case 464:
-#line 2286 "./util/configparser.y"
+#line 2287 "./util/configparser.y"
     {
   	OUTYY(("P(server_ip_ratelimit_size:%s)\n", (yyvsp[0].str)));
   	if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->ip_ratelimit_size))
   		yyerror("memory size expected");
   	free((yyvsp[0].str));
   }
-#line 5341 "util/configparser.c"
+#line 5342 "util/configparser.c"
     break;
 
   case 465:
-#line 2294 "./util/configparser.y"
+#line 2295 "./util/configparser.y"
     {
 		OUTYY(("P(server_ratelimit_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->ratelimit_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 5352 "util/configparser.c"
+#line 5353 "util/configparser.c"
     break;
 
   case 466:
-#line 2302 "./util/configparser.y"
+#line 2303 "./util/configparser.y"
     {
   	OUTYY(("P(server_ip_ratelimit_slabs:%s)\n", (yyvsp[0].str)));
   	if(atoi((yyvsp[0].str)) == 0)
@@ -5364,11 +5365,11 @@ yyreduce:
   	}
   	free((yyvsp[0].str));
   }
-#line 5368 "util/configparser.c"
+#line 5369 "util/configparser.c"
     break;
 
   case 467:
-#line 2315 "./util/configparser.y"
+#line 2316 "./util/configparser.y"
     {
 		OUTYY(("P(server_ratelimit_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -5380,11 +5381,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 5384 "util/configparser.c"
+#line 5385 "util/configparser.c"
     break;
 
   case 468:
-#line 2328 "./util/configparser.y"
+#line 2329 "./util/configparser.y"
     {
 		OUTYY(("P(server_ratelimit_for_domain:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0) {
@@ -5398,11 +5399,11 @@ yyreduce:
 					"ratelimit-for-domain");
 		}
 	}
-#line 5402 "util/configparser.c"
+#line 5403 "util/configparser.c"
     break;
 
   case 469:
-#line 2343 "./util/configparser.y"
+#line 2344 "./util/configparser.y"
     {
 		OUTYY(("P(server_ratelimit_below_domain:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0) {
@@ -5416,11 +5417,11 @@ yyreduce:
 					"ratelimit-below-domain");
 		}
 	}
-#line 5420 "util/configparser.c"
+#line 5421 "util/configparser.c"
     break;
 
   case 470:
-#line 2358 "./util/configparser.y"
+#line 2359 "./util/configparser.y"
     { 
   	OUTYY(("P(server_ip_ratelimit_factor:%s)\n", (yyvsp[0].str))); 
   	if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5428,11 +5429,11 @@ yyreduce:
   	else cfg_parser->cfg->ip_ratelimit_factor = atoi((yyvsp[0].str));
   	free((yyvsp[0].str));
 	}
-#line 5432 "util/configparser.c"
+#line 5433 "util/configparser.c"
     break;
 
   case 471:
-#line 2367 "./util/configparser.y"
+#line 2368 "./util/configparser.y"
     { 
 		OUTYY(("P(server_ratelimit_factor:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5440,20 +5441,20 @@ yyreduce:
 		else cfg_parser->cfg->ratelimit_factor = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5444 "util/configparser.c"
+#line 5445 "util/configparser.c"
     break;
 
   case 472:
-#line 2376 "./util/configparser.y"
+#line 2377 "./util/configparser.y"
     { 
 		OUTYY(("P(low-rtt option is deprecated, use fast-server-num instead)\n"));
 		free((yyvsp[0].str));
 	}
-#line 5453 "util/configparser.c"
+#line 5454 "util/configparser.c"
     break;
 
   case 473:
-#line 2382 "./util/configparser.y"
+#line 2383 "./util/configparser.y"
     { 
 		OUTYY(("P(server_fast_server_num:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) <= 0)
@@ -5461,11 +5462,11 @@ yyreduce:
 		else cfg_parser->cfg->fast_server_num = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5465 "util/configparser.c"
+#line 5466 "util/configparser.c"
     break;
 
   case 474:
-#line 2391 "./util/configparser.y"
+#line 2392 "./util/configparser.y"
     { 
 		OUTYY(("P(server_fast_server_permil:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5473,11 +5474,11 @@ yyreduce:
 		else cfg_parser->cfg->fast_server_permil = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5477 "util/configparser.c"
+#line 5478 "util/configparser.c"
     break;
 
   case 475:
-#line 2400 "./util/configparser.y"
+#line 2401 "./util/configparser.y"
     {
 		OUTYY(("P(server_qname_minimisation:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5486,11 +5487,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5490 "util/configparser.c"
+#line 5491 "util/configparser.c"
     break;
 
   case 476:
-#line 2410 "./util/configparser.y"
+#line 2411 "./util/configparser.y"
     {
 		OUTYY(("P(server_qname_minimisation_strict:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5499,11 +5500,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5503 "util/configparser.c"
+#line 5504 "util/configparser.c"
     break;
 
   case 477:
-#line 2420 "./util/configparser.y"
+#line 2421 "./util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_enabled:%s)\n", (yyvsp[0].str)));
@@ -5515,11 +5516,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 5519 "util/configparser.c"
+#line 5520 "util/configparser.c"
     break;
 
   case 478:
-#line 2433 "./util/configparser.y"
+#line 2434 "./util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_ignore_bogus:%s)\n", (yyvsp[0].str)));
@@ -5531,11 +5532,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 5535 "util/configparser.c"
+#line 5536 "util/configparser.c"
     break;
 
   case 479:
-#line 2446 "./util/configparser.y"
+#line 2447 "./util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_hook:%s)\n", (yyvsp[0].str)));
@@ -5546,11 +5547,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5550 "util/configparser.c"
+#line 5551 "util/configparser.c"
     break;
 
   case 480:
-#line 2458 "./util/configparser.y"
+#line 2459 "./util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_max_ttl:%s)\n", (yyvsp[0].str)));
@@ -5563,11 +5564,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5567 "util/configparser.c"
+#line 5568 "util/configparser.c"
     break;
 
   case 481:
-#line 2472 "./util/configparser.y"
+#line 2473 "./util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_whitelist:%s)\n", (yyvsp[0].str)));
@@ -5578,11 +5579,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5582 "util/configparser.c"
+#line 5583 "util/configparser.c"
     break;
 
   case 482:
-#line 2484 "./util/configparser.y"
+#line 2485 "./util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_strict:%s)\n", (yyvsp[0].str)));
@@ -5595,11 +5596,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5599 "util/configparser.c"
+#line 5600 "util/configparser.c"
     break;
 
   case 483:
-#line 2498 "./util/configparser.y"
+#line 2499 "./util/configparser.y"
     {
 		OUTYY(("P(server_edns_client_string:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str2list_insert(
@@ -5607,11 +5608,11 @@ yyreduce:
 			fatal_exit("out of memory adding "
 				"edns-client-string");
 	}
-#line 5611 "util/configparser.c"
+#line 5612 "util/configparser.c"
     break;
 
   case 484:
-#line 2507 "./util/configparser.y"
+#line 2508 "./util/configparser.y"
     {
 		OUTYY(("P(edns_client_string_opcode:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5622,11 +5623,11 @@ yyreduce:
 		free((yyvsp[0].str));
 
 	}
-#line 5626 "util/configparser.c"
+#line 5627 "util/configparser.c"
     break;
 
   case 485:
-#line 2519 "./util/configparser.y"
+#line 2520 "./util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->stubs->name)
@@ -5635,31 +5636,31 @@ yyreduce:
 		free(cfg_parser->cfg->stubs->name);
 		cfg_parser->cfg->stubs->name = (yyvsp[0].str);
 	}
-#line 5639 "util/configparser.c"
+#line 5640 "util/configparser.c"
     break;
 
   case 486:
-#line 2529 "./util/configparser.y"
+#line 2530 "./util/configparser.y"
     {
 		OUTYY(("P(stub-host:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->hosts, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5649 "util/configparser.c"
+#line 5650 "util/configparser.c"
     break;
 
   case 487:
-#line 2536 "./util/configparser.y"
+#line 2537 "./util/configparser.y"
     {
 		OUTYY(("P(stub-addr:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->addrs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5659 "util/configparser.c"
+#line 5660 "util/configparser.c"
     break;
 
   case 488:
-#line 2543 "./util/configparser.y"
+#line 2544 "./util/configparser.y"
     {
 		OUTYY(("P(stub-first:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5667,11 +5668,11 @@ yyreduce:
 		else cfg_parser->cfg->stubs->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5671 "util/configparser.c"
+#line 5672 "util/configparser.c"
     break;
 
   case 489:
-#line 2552 "./util/configparser.y"
+#line 2553 "./util/configparser.y"
     {
 		OUTYY(("P(stub-no-cache:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5679,11 +5680,11 @@ yyreduce:
 		else cfg_parser->cfg->stubs->no_cache=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5683 "util/configparser.c"
+#line 5684 "util/configparser.c"
     break;
 
   case 490:
-#line 2561 "./util/configparser.y"
+#line 2562 "./util/configparser.y"
     {
 		OUTYY(("P(stub-ssl-upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5692,11 +5693,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5696 "util/configparser.c"
+#line 5697 "util/configparser.c"
     break;
 
   case 491:
-#line 2571 "./util/configparser.y"
+#line 2572 "./util/configparser.y"
     {
 		OUTYY(("P(stub-prime:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5705,11 +5706,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5709 "util/configparser.c"
+#line 5710 "util/configparser.c"
     break;
 
   case 492:
-#line 2581 "./util/configparser.y"
+#line 2582 "./util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->forwards->name)
@@ -5718,31 +5719,31 @@ yyreduce:
 		free(cfg_parser->cfg->forwards->name);
 		cfg_parser->cfg->forwards->name = (yyvsp[0].str);
 	}
-#line 5722 "util/configparser.c"
+#line 5723 "util/configparser.c"
     break;
 
   case 493:
-#line 2591 "./util/configparser.y"
+#line 2592 "./util/configparser.y"
     {
 		OUTYY(("P(forward-host:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->hosts, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5732 "util/configparser.c"
+#line 5733 "util/configparser.c"
     break;
 
   case 494:
-#line 2598 "./util/configparser.y"
+#line 2599 "./util/configparser.y"
     {
 		OUTYY(("P(forward-addr:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->addrs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5742 "util/configparser.c"
+#line 5743 "util/configparser.c"
     break;
 
   case 495:
-#line 2605 "./util/configparser.y"
+#line 2606 "./util/configparser.y"
     {
 		OUTYY(("P(forward-first:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5750,11 +5751,11 @@ yyreduce:
 		else cfg_parser->cfg->forwards->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5754 "util/configparser.c"
+#line 5755 "util/configparser.c"
     break;
 
   case 496:
-#line 2614 "./util/configparser.y"
+#line 2615 "./util/configparser.y"
     {
 		OUTYY(("P(forward-no-cache:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5762,11 +5763,11 @@ yyreduce:
 		else cfg_parser->cfg->forwards->no_cache=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5766 "util/configparser.c"
+#line 5767 "util/configparser.c"
     break;
 
   case 497:
-#line 2623 "./util/configparser.y"
+#line 2624 "./util/configparser.y"
     {
 		OUTYY(("P(forward-ssl-upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5775,11 +5776,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5779 "util/configparser.c"
+#line 5780 "util/configparser.c"
     break;
 
   case 498:
-#line 2633 "./util/configparser.y"
+#line 2634 "./util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->auths->name)
@@ -5788,52 +5789,52 @@ yyreduce:
 		free(cfg_parser->cfg->auths->name);
 		cfg_parser->cfg->auths->name = (yyvsp[0].str);
 	}
-#line 5792 "util/configparser.c"
+#line 5793 "util/configparser.c"
     break;
 
   case 499:
-#line 2643 "./util/configparser.y"
+#line 2644 "./util/configparser.y"
     {
 		OUTYY(("P(zonefile:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->auths->zonefile);
 		cfg_parser->cfg->auths->zonefile = (yyvsp[0].str);
 	}
-#line 5802 "util/configparser.c"
+#line 5803 "util/configparser.c"
     break;
 
   case 500:
-#line 2650 "./util/configparser.y"
+#line 2651 "./util/configparser.y"
     {
 		OUTYY(("P(master:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->auths->masters, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5812 "util/configparser.c"
+#line 5813 "util/configparser.c"
     break;
 
   case 501:
-#line 2657 "./util/configparser.y"
+#line 2658 "./util/configparser.y"
     {
 		OUTYY(("P(url:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->auths->urls, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5822 "util/configparser.c"
+#line 5823 "util/configparser.c"
     break;
 
   case 502:
-#line 2664 "./util/configparser.y"
+#line 2665 "./util/configparser.y"
     {
 		OUTYY(("P(allow-notify:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->auths->allow_notify,
 			(yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5833 "util/configparser.c"
+#line 5834 "util/configparser.c"
     break;
 
   case 503:
-#line 2672 "./util/configparser.y"
+#line 2673 "./util/configparser.y"
     {
 		OUTYY(("P(for-downstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5842,11 +5843,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5846 "util/configparser.c"
+#line 5847 "util/configparser.c"
     break;
 
   case 504:
-#line 2682 "./util/configparser.y"
+#line 2683 "./util/configparser.y"
     {
 		OUTYY(("P(for-upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5855,11 +5856,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5859 "util/configparser.c"
+#line 5860 "util/configparser.c"
     break;
 
   case 505:
-#line 2692 "./util/configparser.y"
+#line 2693 "./util/configparser.y"
     {
 		OUTYY(("P(fallback-enabled:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5868,11 +5869,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5872 "util/configparser.c"
+#line 5873 "util/configparser.c"
     break;
 
   case 506:
-#line 2702 "./util/configparser.y"
+#line 2703 "./util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->views->name)
@@ -5881,11 +5882,11 @@ yyreduce:
 		free(cfg_parser->cfg->views->name);
 		cfg_parser->cfg->views->name = (yyvsp[0].str);
 	}
-#line 5885 "util/configparser.c"
+#line 5886 "util/configparser.c"
     break;
 
   case 507:
-#line 2712 "./util/configparser.y"
+#line 2713 "./util/configparser.y"
     {
 		OUTYY(("P(view_local_zone:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "static")!=0 && strcmp((yyvsp[0].str), "deny")!=0 &&
@@ -5923,11 +5924,11 @@ yyreduce:
 				fatal_exit("out of memory adding local-zone");
 		}
 	}
-#line 5927 "util/configparser.c"
+#line 5928 "util/configparser.c"
     break;
 
   case 508:
-#line 2751 "./util/configparser.y"
+#line 2752 "./util/configparser.y"
     {
 		OUTYY(("P(view_response_ip:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		validate_respip_action((yyvsp[0].str));
@@ -5936,33 +5937,33 @@ yyreduce:
 			fatal_exit("out of memory adding per-view "
 				"response-ip action");
 	}
-#line 5940 "util/configparser.c"
+#line 5941 "util/configparser.c"
     break;
 
   case 509:
-#line 2761 "./util/configparser.y"
+#line 2762 "./util/configparser.y"
     {
 		OUTYY(("P(view_response_ip_data:%s)\n", (yyvsp[-1].str)));
 		if(!cfg_str2list_insert(
 			&cfg_parser->cfg->views->respip_data, (yyvsp[-1].str), (yyvsp[0].str)))
 			fatal_exit("out of memory adding response-ip-data");
 	}
-#line 5951 "util/configparser.c"
+#line 5952 "util/configparser.c"
     break;
 
   case 510:
-#line 2769 "./util/configparser.y"
+#line 2770 "./util/configparser.y"
     {
 		OUTYY(("P(view_local_data:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->views->local_data, (yyvsp[0].str))) {
 			fatal_exit("out of memory adding local-data");
 		}
 	}
-#line 5962 "util/configparser.c"
+#line 5963 "util/configparser.c"
     break;
 
   case 511:
-#line 2777 "./util/configparser.y"
+#line 2778 "./util/configparser.y"
     {
 		char* ptr;
 		OUTYY(("P(view_local_data_ptr:%s)\n", (yyvsp[0].str)));
@@ -5976,11 +5977,11 @@ yyreduce:
 			yyerror("local-data-ptr could not be reversed");
 		}
 	}
-#line 5980 "util/configparser.c"
+#line 5981 "util/configparser.c"
     break;
 
   case 512:
-#line 2792 "./util/configparser.y"
+#line 2793 "./util/configparser.y"
     {
 		OUTYY(("P(view-first:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5988,19 +5989,19 @@ yyreduce:
 		else cfg_parser->cfg->views->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5992 "util/configparser.c"
+#line 5993 "util/configparser.c"
     break;
 
   case 513:
-#line 2801 "./util/configparser.y"
+#line 2802 "./util/configparser.y"
     { 
 		OUTYY(("\nP(remote-control:)\n")); 
 	}
-#line 6000 "util/configparser.c"
+#line 6001 "util/configparser.c"
     break;
 
   case 524:
-#line 2812 "./util/configparser.y"
+#line 2813 "./util/configparser.y"
     {
 		OUTYY(("P(control_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6009,11 +6010,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6013 "util/configparser.c"
+#line 6014 "util/configparser.c"
     break;
 
   case 525:
-#line 2822 "./util/configparser.y"
+#line 2823 "./util/configparser.y"
     {
 		OUTYY(("P(control_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -6021,79 +6022,79 @@ yyreduce:
 		else cfg_parser->cfg->control_port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 6025 "util/configparser.c"
+#line 6026 "util/configparser.c"
     break;
 
   case 526:
-#line 2831 "./util/configparser.y"
+#line 2832 "./util/configparser.y"
     {
 		OUTYY(("P(control_interface:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_append(&cfg_parser->cfg->control_ifs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 6035 "util/configparser.c"
+#line 6036 "util/configparser.c"
     break;
 
   case 527:
-#line 2838 "./util/configparser.y"
+#line 2839 "./util/configparser.y"
     {
 		OUTYY(("P(control_use_cert:%s)\n", (yyvsp[0].str)));
 		cfg_parser->cfg->control_use_cert = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6045 "util/configparser.c"
+#line 6046 "util/configparser.c"
     break;
 
   case 528:
-#line 2845 "./util/configparser.y"
+#line 2846 "./util/configparser.y"
     {
 		OUTYY(("P(rc_server_key_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->server_key_file);
 		cfg_parser->cfg->server_key_file = (yyvsp[0].str);
 	}
-#line 6055 "util/configparser.c"
+#line 6056 "util/configparser.c"
     break;
 
   case 529:
-#line 2852 "./util/configparser.y"
+#line 2853 "./util/configparser.y"
     {
 		OUTYY(("P(rc_server_cert_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->server_cert_file);
 		cfg_parser->cfg->server_cert_file = (yyvsp[0].str);
 	}
-#line 6065 "util/configparser.c"
+#line 6066 "util/configparser.c"
     break;
 
   case 530:
-#line 2859 "./util/configparser.y"
+#line 2860 "./util/configparser.y"
     {
 		OUTYY(("P(rc_control_key_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->control_key_file);
 		cfg_parser->cfg->control_key_file = (yyvsp[0].str);
 	}
-#line 6075 "util/configparser.c"
+#line 6076 "util/configparser.c"
     break;
 
   case 531:
-#line 2866 "./util/configparser.y"
+#line 2867 "./util/configparser.y"
     {
 		OUTYY(("P(rc_control_cert_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->control_cert_file);
 		cfg_parser->cfg->control_cert_file = (yyvsp[0].str);
 	}
-#line 6085 "util/configparser.c"
+#line 6086 "util/configparser.c"
     break;
 
   case 532:
-#line 2873 "./util/configparser.y"
+#line 2874 "./util/configparser.y"
     {
 		OUTYY(("\nP(dnstap:)\n"));
 	}
-#line 6093 "util/configparser.c"
+#line 6094 "util/configparser.c"
     break;
 
   case 554:
-#line 2893 "./util/configparser.y"
+#line 2894 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6101,11 +6102,11 @@ yyreduce:
 		else cfg_parser->cfg->dnstap = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6105 "util/configparser.c"
+#line 6106 "util/configparser.c"
     break;
 
   case 555:
-#line 2902 "./util/configparser.y"
+#line 2903 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_bidirectional:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6114,31 +6115,31 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6118 "util/configparser.c"
+#line 6119 "util/configparser.c"
     break;
 
   case 556:
-#line 2912 "./util/configparser.y"
+#line 2913 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_socket_path:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_socket_path);
 		cfg_parser->cfg->dnstap_socket_path = (yyvsp[0].str);
 	}
-#line 6128 "util/configparser.c"
+#line 6129 "util/configparser.c"
     break;
 
   case 557:
-#line 2919 "./util/configparser.y"
+#line 2920 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_ip:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_ip);
 		cfg_parser->cfg->dnstap_ip = (yyvsp[0].str);
 	}
-#line 6138 "util/configparser.c"
+#line 6139 "util/configparser.c"
     break;
 
   case 558:
-#line 2926 "./util/configparser.y"
+#line 2927 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_tls:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6146,51 +6147,51 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_tls = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6150 "util/configparser.c"
+#line 6151 "util/configparser.c"
     break;
 
   case 559:
-#line 2935 "./util/configparser.y"
+#line 2936 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_tls_server_name:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_tls_server_name);
 		cfg_parser->cfg->dnstap_tls_server_name = (yyvsp[0].str);
 	}
-#line 6160 "util/configparser.c"
+#line 6161 "util/configparser.c"
     break;
 
   case 560:
-#line 2942 "./util/configparser.y"
+#line 2943 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_tls_cert_bundle:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_tls_cert_bundle);
 		cfg_parser->cfg->dnstap_tls_cert_bundle = (yyvsp[0].str);
 	}
-#line 6170 "util/configparser.c"
+#line 6171 "util/configparser.c"
     break;
 
   case 561:
-#line 2949 "./util/configparser.y"
+#line 2950 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_tls_client_key_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_tls_client_key_file);
 		cfg_parser->cfg->dnstap_tls_client_key_file = (yyvsp[0].str);
 	}
-#line 6180 "util/configparser.c"
+#line 6181 "util/configparser.c"
     break;
 
   case 562:
-#line 2956 "./util/configparser.y"
+#line 2957 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_tls_client_cert_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_tls_client_cert_file);
 		cfg_parser->cfg->dnstap_tls_client_cert_file = (yyvsp[0].str);
 	}
-#line 6190 "util/configparser.c"
+#line 6191 "util/configparser.c"
     break;
 
   case 563:
-#line 2963 "./util/configparser.y"
+#line 2964 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_send_identity:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6198,11 +6199,11 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_send_identity = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6202 "util/configparser.c"
+#line 6203 "util/configparser.c"
     break;
 
   case 564:
-#line 2972 "./util/configparser.y"
+#line 2973 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_send_version:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6210,31 +6211,31 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_send_version = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6214 "util/configparser.c"
+#line 6215 "util/configparser.c"
     break;
 
   case 565:
-#line 2981 "./util/configparser.y"
+#line 2982 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_identity:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_identity);
 		cfg_parser->cfg->dnstap_identity = (yyvsp[0].str);
 	}
-#line 6224 "util/configparser.c"
+#line 6225 "util/configparser.c"
     break;
 
   case 566:
-#line 2988 "./util/configparser.y"
+#line 2989 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_version:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_version);
 		cfg_parser->cfg->dnstap_version = (yyvsp[0].str);
 	}
-#line 6234 "util/configparser.c"
+#line 6235 "util/configparser.c"
     break;
 
   case 567:
-#line 2995 "./util/configparser.y"
+#line 2996 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_resolver_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6243,11 +6244,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6247 "util/configparser.c"
+#line 6248 "util/configparser.c"
     break;
 
   case 568:
-#line 3005 "./util/configparser.y"
+#line 3006 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_resolver_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6256,11 +6257,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6260 "util/configparser.c"
+#line 6261 "util/configparser.c"
     break;
 
   case 569:
-#line 3015 "./util/configparser.y"
+#line 3016 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_client_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6269,11 +6270,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6273 "util/configparser.c"
+#line 6274 "util/configparser.c"
     break;
 
   case 570:
-#line 3025 "./util/configparser.y"
+#line 3026 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_client_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6282,11 +6283,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6286 "util/configparser.c"
+#line 6287 "util/configparser.c"
     break;
 
   case 571:
-#line 3035 "./util/configparser.y"
+#line 3036 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_forwarder_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6295,11 +6296,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6299 "util/configparser.c"
+#line 6300 "util/configparser.c"
     break;
 
   case 572:
-#line 3045 "./util/configparser.y"
+#line 3046 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_forwarder_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6308,47 +6309,47 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6312 "util/configparser.c"
+#line 6313 "util/configparser.c"
     break;
 
   case 573:
-#line 3055 "./util/configparser.y"
+#line 3056 "./util/configparser.y"
     { 
 		OUTYY(("\nP(python:)\n")); 
 	}
-#line 6320 "util/configparser.c"
+#line 6321 "util/configparser.c"
     break;
 
   case 577:
-#line 3064 "./util/configparser.y"
+#line 3065 "./util/configparser.y"
     {
 		OUTYY(("P(python-script:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_append_ex(&cfg_parser->cfg->python_script, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 6330 "util/configparser.c"
+#line 6331 "util/configparser.c"
     break;
 
   case 578:
-#line 3070 "./util/configparser.y"
+#line 3071 "./util/configparser.y"
     { 
 		OUTYY(("\nP(dynlib:)\n")); 
 	}
-#line 6338 "util/configparser.c"
+#line 6339 "util/configparser.c"
     break;
 
   case 582:
-#line 3079 "./util/configparser.y"
+#line 3080 "./util/configparser.y"
     {
 		OUTYY(("P(dynlib-file:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_append_ex(&cfg_parser->cfg->dynlib_file, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 6348 "util/configparser.c"
+#line 6349 "util/configparser.c"
     break;
 
   case 583:
-#line 3085 "./util/configparser.y"
+#line 3086 "./util/configparser.y"
     {
 		OUTYY(("P(disable_dnssec_lame_check:%s)\n", (yyvsp[0].str)));
 		if (strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6357,21 +6358,21 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6361 "util/configparser.c"
+#line 6362 "util/configparser.c"
     break;
 
   case 584:
-#line 3095 "./util/configparser.y"
+#line 3096 "./util/configparser.y"
     {
 		OUTYY(("P(server_log_identity:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->log_identity);
 		cfg_parser->cfg->log_identity = (yyvsp[0].str);
 	}
-#line 6371 "util/configparser.c"
+#line 6372 "util/configparser.c"
     break;
 
   case 585:
-#line 3102 "./util/configparser.y"
+#line 3103 "./util/configparser.y"
     {
 		OUTYY(("P(server_response_ip:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		validate_respip_action((yyvsp[0].str));
@@ -6379,30 +6380,30 @@ yyreduce:
 			(yyvsp[-1].str), (yyvsp[0].str)))
 			fatal_exit("out of memory adding response-ip");
 	}
-#line 6383 "util/configparser.c"
+#line 6384 "util/configparser.c"
     break;
 
   case 586:
-#line 3111 "./util/configparser.y"
+#line 3112 "./util/configparser.y"
     {
 		OUTYY(("P(server_response_ip_data:%s)\n", (yyvsp[-1].str)));
 		if(!cfg_str2list_insert(&cfg_parser->cfg->respip_data,
 			(yyvsp[-1].str), (yyvsp[0].str)))
 			fatal_exit("out of memory adding response-ip-data");
 	}
-#line 6394 "util/configparser.c"
+#line 6395 "util/configparser.c"
     break;
 
   case 587:
-#line 3119 "./util/configparser.y"
+#line 3120 "./util/configparser.y"
     {
 		OUTYY(("\nP(dnscrypt:)\n"));
 	}
-#line 6402 "util/configparser.c"
+#line 6403 "util/configparser.c"
     break;
 
   case 600:
-#line 3135 "./util/configparser.y"
+#line 3136 "./util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6410,11 +6411,11 @@ yyreduce:
 		else cfg_parser->cfg->dnscrypt = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6414 "util/configparser.c"
+#line 6415 "util/configparser.c"
     break;
 
   case 601:
-#line 3145 "./util/configparser.y"
+#line 3146 "./util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -6422,21 +6423,21 @@ yyreduce:
 		else cfg_parser->cfg->dnscrypt_port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 6426 "util/configparser.c"
+#line 6427 "util/configparser.c"
     break;
 
   case 602:
-#line 3154 "./util/configparser.y"
+#line 3155 "./util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_provider:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnscrypt_provider);
 		cfg_parser->cfg->dnscrypt_provider = (yyvsp[0].str);
 	}
-#line 6436 "util/configparser.c"
+#line 6437 "util/configparser.c"
     break;
 
   case 603:
-#line 3161 "./util/configparser.y"
+#line 3162 "./util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_provider_cert:%s)\n", (yyvsp[0].str)));
 		if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_provider_cert, (yyvsp[0].str)))
@@ -6444,21 +6445,21 @@ yyreduce:
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_provider_cert, (yyvsp[0].str)))
 			fatal_exit("out of memory adding dnscrypt-provider-cert");
 	}
-#line 6448 "util/configparser.c"
+#line 6449 "util/configparser.c"
     break;
 
   case 604:
-#line 3170 "./util/configparser.y"
+#line 3171 "./util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_provider_cert_rotated:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_provider_cert_rotated, (yyvsp[0].str)))
 			fatal_exit("out of memory adding dnscrypt-provider-cert-rotated");
 	}
-#line 6458 "util/configparser.c"
+#line 6459 "util/configparser.c"
     break;
 
   case 605:
-#line 3177 "./util/configparser.y"
+#line 3178 "./util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_secret_key:%s)\n", (yyvsp[0].str)));
 		if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_secret_key, (yyvsp[0].str)))
@@ -6466,22 +6467,22 @@ yyreduce:
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_secret_key, (yyvsp[0].str)))
 			fatal_exit("out of memory adding dnscrypt-secret-key");
 	}
-#line 6470 "util/configparser.c"
+#line 6471 "util/configparser.c"
     break;
 
   case 606:
-#line 3186 "./util/configparser.y"
+#line 3187 "./util/configparser.y"
     {
   	OUTYY(("P(dnscrypt_shared_secret_cache_size:%s)\n", (yyvsp[0].str)));
   	if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->dnscrypt_shared_secret_cache_size))
   		yyerror("memory size expected");
   	free((yyvsp[0].str));
   }
-#line 6481 "util/configparser.c"
+#line 6482 "util/configparser.c"
     break;
 
   case 607:
-#line 3194 "./util/configparser.y"
+#line 3195 "./util/configparser.y"
     {
   	OUTYY(("P(dnscrypt_shared_secret_cache_slabs:%s)\n", (yyvsp[0].str)));
   	if(atoi((yyvsp[0].str)) == 0)
@@ -6493,22 +6494,22 @@ yyreduce:
   	}
   	free((yyvsp[0].str));
   }
-#line 6497 "util/configparser.c"
+#line 6498 "util/configparser.c"
     break;
 
   case 608:
-#line 3207 "./util/configparser.y"
+#line 3208 "./util/configparser.y"
     {
   	OUTYY(("P(dnscrypt_nonce_cache_size:%s)\n", (yyvsp[0].str)));
   	if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->dnscrypt_nonce_cache_size))
   		yyerror("memory size expected");
   	free((yyvsp[0].str));
   }
-#line 6508 "util/configparser.c"
+#line 6509 "util/configparser.c"
     break;
 
   case 609:
-#line 3215 "./util/configparser.y"
+#line 3216 "./util/configparser.y"
     {
   	OUTYY(("P(dnscrypt_nonce_cache_slabs:%s)\n", (yyvsp[0].str)));
   	if(atoi((yyvsp[0].str)) == 0)
@@ -6520,19 +6521,19 @@ yyreduce:
   	}
   	free((yyvsp[0].str));
   }
-#line 6524 "util/configparser.c"
+#line 6525 "util/configparser.c"
     break;
 
   case 610:
-#line 3228 "./util/configparser.y"
+#line 3229 "./util/configparser.y"
     {
 		OUTYY(("\nP(cachedb:)\n"));
 	}
-#line 6532 "util/configparser.c"
+#line 6533 "util/configparser.c"
     break;
 
   case 619:
-#line 3239 "./util/configparser.y"
+#line 3240 "./util/configparser.y"
     {
 	#ifdef USE_CACHEDB
 		OUTYY(("P(backend:%s)\n", (yyvsp[0].str)));
@@ -6543,11 +6544,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 6547 "util/configparser.c"
+#line 6548 "util/configparser.c"
     break;
 
   case 620:
-#line 3251 "./util/configparser.y"
+#line 3252 "./util/configparser.y"
     {
 	#ifdef USE_CACHEDB
 		OUTYY(("P(secret-seed:%s)\n", (yyvsp[0].str)));
@@ -6558,11 +6559,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 6562 "util/configparser.c"
+#line 6563 "util/configparser.c"
     break;
 
   case 621:
-#line 3263 "./util/configparser.y"
+#line 3264 "./util/configparser.y"
     {
 	#if defined(USE_CACHEDB) && defined(USE_REDIS)
 		OUTYY(("P(redis_server_host:%s)\n", (yyvsp[0].str)));
@@ -6573,11 +6574,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 6577 "util/configparser.c"
+#line 6578 "util/configparser.c"
     break;
 
   case 622:
-#line 3275 "./util/configparser.y"
+#line 3276 "./util/configparser.y"
     {
 	#if defined(USE_CACHEDB) && defined(USE_REDIS)
 		int port;
@@ -6591,11 +6592,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 6595 "util/configparser.c"
+#line 6596 "util/configparser.c"
     break;
 
   case 623:
-#line 3290 "./util/configparser.y"
+#line 3291 "./util/configparser.y"
     {
 	#if defined(USE_CACHEDB) && defined(USE_REDIS)
 		OUTYY(("P(redis_timeout:%s)\n", (yyvsp[0].str)));
@@ -6607,11 +6608,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 6611 "util/configparser.c"
+#line 6612 "util/configparser.c"
     break;
 
   case 624:
-#line 3303 "./util/configparser.y"
+#line 3304 "./util/configparser.y"
     {
 	#if defined(USE_CACHEDB) && defined(USE_REDIS)
 		OUTYY(("P(redis_expire_records:%s)\n", (yyvsp[0].str)));
@@ -6623,11 +6624,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 6627 "util/configparser.c"
+#line 6628 "util/configparser.c"
     break;
 
   case 625:
-#line 3316 "./util/configparser.y"
+#line 3317 "./util/configparser.y"
     {
 		OUTYY(("P(server_tcp_connection_limit:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if (atoi((yyvsp[0].str)) < 0)
@@ -6637,19 +6638,19 @@ yyreduce:
 				fatal_exit("out of memory adding tcp connection limit");
 		}
 	}
-#line 6641 "util/configparser.c"
+#line 6642 "util/configparser.c"
     break;
 
   case 626:
-#line 3327 "./util/configparser.y"
+#line 3328 "./util/configparser.y"
     {
 			OUTYY(("\nP(ipset:)\n"));
 		}
-#line 6649 "util/configparser.c"
+#line 6650 "util/configparser.c"
     break;
 
   case 631:
-#line 3336 "./util/configparser.y"
+#line 3337 "./util/configparser.y"
     {
 		#ifdef USE_IPSET
 			OUTYY(("P(name-v4:%s)\n", (yyvsp[0].str)));
@@ -6663,11 +6664,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		#endif
 		}
-#line 6667 "util/configparser.c"
+#line 6668 "util/configparser.c"
     break;
 
   case 632:
-#line 3351 "./util/configparser.y"
+#line 3352 "./util/configparser.y"
     {
 		#ifdef USE_IPSET
 			OUTYY(("P(name-v6:%s)\n", (yyvsp[0].str)));
@@ -6681,11 +6682,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		#endif
 		}
-#line 6685 "util/configparser.c"
+#line 6686 "util/configparser.c"
     break;
 
 
-#line 6689 "util/configparser.c"
+#line 6690 "util/configparser.c"
 
       default: break;
     }
@@ -6917,7 +6918,7 @@ yyreturn:
 #endif
   return yyresult;
 }
-#line 3365 "./util/configparser.y"
+#line 3366 "./util/configparser.y"
 
 
 /* parse helper routines could be here */
diff --git a/util/configparser.y b/util/configparser.y
index 4d6b5e3fb..cc965a477 100644
--- a/util/configparser.y
+++ b/util/configparser.y
@@ -2030,6 +2030,7 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
 		   && strcmp($3, "always_transparent")!=0
 		   && strcmp($3, "always_refuse")!=0
 		   && strcmp($3, "always_nxdomain")!=0
+		   && strcmp($3, "always_null")!=0
 		   && strcmp($3, "noview")!=0
 		   && strcmp($3, "inform")!=0 && strcmp($3, "inform_deny")!=0
 		   && strcmp($3, "inform_redirect") != 0
@@ -2038,8 +2039,8 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
 				"refuse, redirect, transparent, "
 				"typetransparent, inform, inform_deny, "
 				"inform_redirect, always_transparent, "
-				"always_refuse, always_nxdomain, noview "
-				", nodefault or ipset");
+				"always_refuse, always_nxdomain, always_null, "
+				"noview, nodefault or ipset");
 			free($2);
 			free($3);
 		} else if(strcmp($3, "nodefault")==0) {

From d1b92a6ce22d1eb8c3da2a6691033a07046035a7 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Tue, 12 Jan 2021 13:39:07 +0100
Subject: [PATCH 34/44] - Fix so local zone types always_nodata and always_deny
 can be used   from the config file.

---
 doc/Changelog       |   2 +
 doc/example.conf.in |   5 +-
 util/configparser.c | 559 ++++++++++++++++++++++----------------------
 util/configparser.y |   5 +-
 4 files changed, 290 insertions(+), 281 deletions(-)

diff --git a/doc/Changelog b/doc/Changelog
index 2cd7baf00..b9d449371 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,8 @@
 12 January 2021: Wouter
 	- Fix #397: [Feature request] add new type always_null to local-zone
 	  similar to always_nxdomain.
+	- Fix so local zone types always_nodata and always_deny can be used
+	  from the config file.
 
 8 January 2021: Wouter
 	- Merge PR #391 from fhriley: Add start_time to reply callbacks so
diff --git a/doc/example.conf.in b/doc/example.conf.in
index c3c7c0f26..b51bcfca5 100644
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -704,8 +704,9 @@ server:
 	# o inform acts like transparent, but logs client IP address
 	# o inform_deny drops queries and logs client IP address
 	# o inform_redirect redirects queries and logs client IP address
-	# o always_transparent, always_refuse, always_nxdomain, resolve in
-	#   that way but ignore local data for that name
+	# o always_transparent, always_refuse, always_nxdomain, always_nodata,
+	#   always_deny resolve in that way but ignore local data for
+	#   that name
 	# o always_null returns 0.0.0.0 or ::0 for any name in the zone.
 	# o noview breaks out of that view towards global local-zones.
 	#
diff --git a/util/configparser.c b/util/configparser.c
index cc5d9fb5e..c8ea478ea 100644
--- a/util/configparser.c
+++ b/util/configparser.c
@@ -1125,26 +1125,26 @@ static const yytype_uint16 yyrline[] =
     1680,  1689,  1698,  1707,  1714,  1724,  1744,  1751,  1769,  1782,
     1795,  1804,  1813,  1822,  1831,  1841,  1851,  1862,  1871,  1880,
     1889,  1898,  1907,  1916,  1929,  1942,  1951,  1958,  1967,  1976,
-    1985,  1994,  2002,  2015,  2023,  2065,  2072,  2087,  2097,  2107,
-    2114,  2121,  2128,  2137,  2145,  2159,  2180,  2201,  2213,  2225,
-    2237,  2246,  2267,  2277,  2286,  2294,  2302,  2315,  2328,  2343,
-    2358,  2367,  2376,  2382,  2391,  2400,  2410,  2420,  2433,  2446,
-    2458,  2472,  2484,  2498,  2507,  2519,  2529,  2536,  2543,  2552,
-    2561,  2571,  2581,  2591,  2598,  2605,  2614,  2623,  2633,  2643,
-    2650,  2657,  2664,  2672,  2682,  2692,  2702,  2712,  2751,  2761,
-    2769,  2777,  2792,  2801,  2806,  2807,  2808,  2808,  2808,  2809,
-    2809,  2809,  2810,  2810,  2812,  2822,  2831,  2838,  2845,  2852,
-    2859,  2866,  2873,  2878,  2879,  2880,  2880,  2880,  2881,  2881,
-    2881,  2882,  2883,  2883,  2884,  2884,  2885,  2885,  2886,  2887,
-    2888,  2889,  2890,  2891,  2893,  2902,  2912,  2919,  2926,  2935,
-    2942,  2949,  2956,  2963,  2972,  2981,  2988,  2995,  3005,  3015,
-    3025,  3035,  3045,  3055,  3060,  3061,  3062,  3064,  3070,  3075,
-    3076,  3077,  3079,  3085,  3095,  3102,  3111,  3119,  3124,  3125,
-    3127,  3127,  3127,  3128,  3128,  3129,  3130,  3131,  3132,  3133,
-    3135,  3145,  3154,  3161,  3170,  3177,  3186,  3194,  3207,  3215,
-    3228,  3233,  3234,  3235,  3235,  3236,  3236,  3236,  3237,  3239,
-    3251,  3263,  3275,  3290,  3303,  3316,  3327,  3332,  3333,  3334,
-    3334,  3336,  3351
+    1985,  1994,  2002,  2015,  2023,  2068,  2075,  2090,  2100,  2110,
+    2117,  2124,  2131,  2140,  2148,  2162,  2183,  2204,  2216,  2228,
+    2240,  2249,  2270,  2280,  2289,  2297,  2305,  2318,  2331,  2346,
+    2361,  2370,  2379,  2385,  2394,  2403,  2413,  2423,  2436,  2449,
+    2461,  2475,  2487,  2501,  2510,  2522,  2532,  2539,  2546,  2555,
+    2564,  2574,  2584,  2594,  2601,  2608,  2617,  2626,  2636,  2646,
+    2653,  2660,  2667,  2675,  2685,  2695,  2705,  2715,  2754,  2764,
+    2772,  2780,  2795,  2804,  2809,  2810,  2811,  2811,  2811,  2812,
+    2812,  2812,  2813,  2813,  2815,  2825,  2834,  2841,  2848,  2855,
+    2862,  2869,  2876,  2881,  2882,  2883,  2883,  2883,  2884,  2884,
+    2884,  2885,  2886,  2886,  2887,  2887,  2888,  2888,  2889,  2890,
+    2891,  2892,  2893,  2894,  2896,  2905,  2915,  2922,  2929,  2938,
+    2945,  2952,  2959,  2966,  2975,  2984,  2991,  2998,  3008,  3018,
+    3028,  3038,  3048,  3058,  3063,  3064,  3065,  3067,  3073,  3078,
+    3079,  3080,  3082,  3088,  3098,  3105,  3114,  3122,  3127,  3128,
+    3130,  3130,  3130,  3131,  3131,  3132,  3133,  3134,  3135,  3136,
+    3138,  3148,  3157,  3164,  3173,  3180,  3189,  3197,  3210,  3218,
+    3231,  3236,  3237,  3238,  3238,  3239,  3239,  3239,  3240,  3242,
+    3254,  3266,  3278,  3293,  3306,  3319,  3330,  3335,  3336,  3337,
+    3337,  3339,  3354
 };
 #endif
 
@@ -5019,6 +5019,8 @@ yyreduce:
 		   && strcmp((yyvsp[0].str), "always_transparent")!=0
 		   && strcmp((yyvsp[0].str), "always_refuse")!=0
 		   && strcmp((yyvsp[0].str), "always_nxdomain")!=0
+		   && strcmp((yyvsp[0].str), "always_nodata")!=0
+		   && strcmp((yyvsp[0].str), "always_deny")!=0
 		   && strcmp((yyvsp[0].str), "always_null")!=0
 		   && strcmp((yyvsp[0].str), "noview")!=0
 		   && strcmp((yyvsp[0].str), "inform")!=0 && strcmp((yyvsp[0].str), "inform_deny")!=0
@@ -5028,7 +5030,8 @@ yyreduce:
 				"refuse, redirect, transparent, "
 				"typetransparent, inform, inform_deny, "
 				"inform_redirect, always_transparent, "
-				"always_refuse, always_nxdomain, always_null, "
+				"always_refuse, always_nxdomain, "
+				"always_nodata, always_deny, always_null, "
 				"noview, nodefault or ipset");
 			free((yyvsp[-1].str));
 			free((yyvsp[0].str));
@@ -5050,21 +5053,21 @@ yyreduce:
 				fatal_exit("out of memory adding local-zone");
 		}
 	}
-#line 5054 "util/configparser.c"
+#line 5057 "util/configparser.c"
     break;
 
   case 445:
-#line 2066 "./util/configparser.y"
+#line 2069 "./util/configparser.y"
     {
 		OUTYY(("P(server_local_data:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->local_data, (yyvsp[0].str)))
 			fatal_exit("out of memory adding local-data");
 	}
-#line 5064 "util/configparser.c"
+#line 5067 "util/configparser.c"
     break;
 
   case 446:
-#line 2073 "./util/configparser.y"
+#line 2076 "./util/configparser.y"
     {
 		char* ptr;
 		OUTYY(("P(server_local_data_ptr:%s)\n", (yyvsp[0].str)));
@@ -5078,11 +5081,11 @@ yyreduce:
 			yyerror("local-data-ptr could not be reversed");
 		}
 	}
-#line 5082 "util/configparser.c"
+#line 5085 "util/configparser.c"
     break;
 
   case 447:
-#line 2088 "./util/configparser.y"
+#line 2091 "./util/configparser.y"
     {
 		OUTYY(("P(server_minimal_responses:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5091,11 +5094,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5095 "util/configparser.c"
+#line 5098 "util/configparser.c"
     break;
 
   case 448:
-#line 2098 "./util/configparser.y"
+#line 2101 "./util/configparser.y"
     {
 		OUTYY(("P(server_rrset_roundrobin:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5104,41 +5107,41 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5108 "util/configparser.c"
+#line 5111 "util/configparser.c"
     break;
 
   case 449:
-#line 2108 "./util/configparser.y"
+#line 2111 "./util/configparser.y"
     {
 		OUTYY(("P(server_unknown_server_time_limit:%s)\n", (yyvsp[0].str)));
 		cfg_parser->cfg->unknown_server_time_limit = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5118 "util/configparser.c"
+#line 5121 "util/configparser.c"
     break;
 
   case 450:
-#line 2115 "./util/configparser.y"
+#line 2118 "./util/configparser.y"
     {
 		OUTYY(("P(server_max_udp_size:%s)\n", (yyvsp[0].str)));
 		cfg_parser->cfg->max_udp_size = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5128 "util/configparser.c"
+#line 5131 "util/configparser.c"
     break;
 
   case 451:
-#line 2122 "./util/configparser.y"
+#line 2125 "./util/configparser.y"
     {
 		OUTYY(("P(dns64_prefix:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dns64_prefix);
 		cfg_parser->cfg->dns64_prefix = (yyvsp[0].str);
 	}
-#line 5138 "util/configparser.c"
+#line 5141 "util/configparser.c"
     break;
 
   case 452:
-#line 2129 "./util/configparser.y"
+#line 2132 "./util/configparser.y"
     {
 		OUTYY(("P(server_dns64_synthall:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5146,22 +5149,22 @@ yyreduce:
 		else cfg_parser->cfg->dns64_synthall = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5150 "util/configparser.c"
+#line 5153 "util/configparser.c"
     break;
 
   case 453:
-#line 2138 "./util/configparser.y"
+#line 2141 "./util/configparser.y"
     {
 		OUTYY(("P(dns64_ignore_aaaa:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dns64_ignore_aaaa,
 			(yyvsp[0].str)))
 			fatal_exit("out of memory adding dns64-ignore-aaaa");
 	}
-#line 5161 "util/configparser.c"
+#line 5164 "util/configparser.c"
     break;
 
   case 454:
-#line 2146 "./util/configparser.y"
+#line 2149 "./util/configparser.y"
     {
 		char* p, *s = (yyvsp[0].str);
 		OUTYY(("P(server_define_tag:%s)\n", (yyvsp[0].str)));
@@ -5174,11 +5177,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 5178 "util/configparser.c"
+#line 5181 "util/configparser.c"
     break;
 
   case 455:
-#line 2160 "./util/configparser.y"
+#line 2163 "./util/configparser.y"
     {
 		size_t len = 0;
 		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@ -5198,11 +5201,11 @@ yyreduce:
 			}
 		}
 	}
-#line 5202 "util/configparser.c"
+#line 5205 "util/configparser.c"
     break;
 
   case 456:
-#line 2181 "./util/configparser.y"
+#line 2184 "./util/configparser.y"
     {
 		size_t len = 0;
 		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@ -5222,11 +5225,11 @@ yyreduce:
 			}
 		}
 	}
-#line 5226 "util/configparser.c"
+#line 5229 "util/configparser.c"
     break;
 
   case 457:
-#line 2202 "./util/configparser.y"
+#line 2205 "./util/configparser.y"
     {
 		OUTYY(("P(server_access_control_tag_action:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_actions,
@@ -5237,11 +5240,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		}
 	}
-#line 5241 "util/configparser.c"
+#line 5244 "util/configparser.c"
     break;
 
   case 458:
-#line 2214 "./util/configparser.y"
+#line 2217 "./util/configparser.y"
     {
 		OUTYY(("P(server_access_control_tag_data:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_datas,
@@ -5252,11 +5255,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		}
 	}
-#line 5256 "util/configparser.c"
+#line 5259 "util/configparser.c"
     break;
 
   case 459:
-#line 2226 "./util/configparser.y"
+#line 2229 "./util/configparser.y"
     {
 		OUTYY(("P(server_local_zone_override:%s %s %s)\n", (yyvsp[-2].str), (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str3list_insert(&cfg_parser->cfg->local_zone_overrides,
@@ -5267,11 +5270,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		}
 	}
-#line 5271 "util/configparser.c"
+#line 5274 "util/configparser.c"
     break;
 
   case 460:
-#line 2238 "./util/configparser.y"
+#line 2241 "./util/configparser.y"
     {
 		OUTYY(("P(server_access_control_view:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str2list_insert(&cfg_parser->cfg->acl_view,
@@ -5279,11 +5282,11 @@ yyreduce:
 			yyerror("out of memory");
 		}
 	}
-#line 5283 "util/configparser.c"
+#line 5286 "util/configparser.c"
     break;
 
   case 461:
-#line 2247 "./util/configparser.y"
+#line 2250 "./util/configparser.y"
     {
 		size_t len = 0;
 		uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, (yyvsp[0].str),
@@ -5303,11 +5306,11 @@ yyreduce:
 			}
 		}
 	}
-#line 5307 "util/configparser.c"
+#line 5310 "util/configparser.c"
     break;
 
   case 462:
-#line 2268 "./util/configparser.y"
+#line 2271 "./util/configparser.y"
     { 
 		OUTYY(("P(server_ip_ratelimit:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5315,11 +5318,11 @@ yyreduce:
 		else cfg_parser->cfg->ip_ratelimit = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5319 "util/configparser.c"
+#line 5322 "util/configparser.c"
     break;
 
   case 463:
-#line 2278 "./util/configparser.y"
+#line 2281 "./util/configparser.y"
     { 
 		OUTYY(("P(server_ratelimit:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5327,33 +5330,33 @@ yyreduce:
 		else cfg_parser->cfg->ratelimit = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5331 "util/configparser.c"
+#line 5334 "util/configparser.c"
     break;
 
   case 464:
-#line 2287 "./util/configparser.y"
+#line 2290 "./util/configparser.y"
     {
   	OUTYY(("P(server_ip_ratelimit_size:%s)\n", (yyvsp[0].str)));
   	if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->ip_ratelimit_size))
   		yyerror("memory size expected");
   	free((yyvsp[0].str));
   }
-#line 5342 "util/configparser.c"
+#line 5345 "util/configparser.c"
     break;
 
   case 465:
-#line 2295 "./util/configparser.y"
+#line 2298 "./util/configparser.y"
     {
 		OUTYY(("P(server_ratelimit_size:%s)\n", (yyvsp[0].str)));
 		if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->ratelimit_size))
 			yyerror("memory size expected");
 		free((yyvsp[0].str));
 	}
-#line 5353 "util/configparser.c"
+#line 5356 "util/configparser.c"
     break;
 
   case 466:
-#line 2303 "./util/configparser.y"
+#line 2306 "./util/configparser.y"
     {
   	OUTYY(("P(server_ip_ratelimit_slabs:%s)\n", (yyvsp[0].str)));
   	if(atoi((yyvsp[0].str)) == 0)
@@ -5365,11 +5368,11 @@ yyreduce:
   	}
   	free((yyvsp[0].str));
   }
-#line 5369 "util/configparser.c"
+#line 5372 "util/configparser.c"
     break;
 
   case 467:
-#line 2316 "./util/configparser.y"
+#line 2319 "./util/configparser.y"
     {
 		OUTYY(("P(server_ratelimit_slabs:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -5381,11 +5384,11 @@ yyreduce:
 		}
 		free((yyvsp[0].str));
 	}
-#line 5385 "util/configparser.c"
+#line 5388 "util/configparser.c"
     break;
 
   case 468:
-#line 2329 "./util/configparser.y"
+#line 2332 "./util/configparser.y"
     {
 		OUTYY(("P(server_ratelimit_for_domain:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0) {
@@ -5399,11 +5402,11 @@ yyreduce:
 					"ratelimit-for-domain");
 		}
 	}
-#line 5403 "util/configparser.c"
+#line 5406 "util/configparser.c"
     break;
 
   case 469:
-#line 2344 "./util/configparser.y"
+#line 2347 "./util/configparser.y"
     {
 		OUTYY(("P(server_ratelimit_below_domain:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0) {
@@ -5417,11 +5420,11 @@ yyreduce:
 					"ratelimit-below-domain");
 		}
 	}
-#line 5421 "util/configparser.c"
+#line 5424 "util/configparser.c"
     break;
 
   case 470:
-#line 2359 "./util/configparser.y"
+#line 2362 "./util/configparser.y"
     { 
   	OUTYY(("P(server_ip_ratelimit_factor:%s)\n", (yyvsp[0].str))); 
   	if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5429,11 +5432,11 @@ yyreduce:
   	else cfg_parser->cfg->ip_ratelimit_factor = atoi((yyvsp[0].str));
   	free((yyvsp[0].str));
 	}
-#line 5433 "util/configparser.c"
+#line 5436 "util/configparser.c"
     break;
 
   case 471:
-#line 2368 "./util/configparser.y"
+#line 2371 "./util/configparser.y"
     { 
 		OUTYY(("P(server_ratelimit_factor:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5441,20 +5444,20 @@ yyreduce:
 		else cfg_parser->cfg->ratelimit_factor = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5445 "util/configparser.c"
+#line 5448 "util/configparser.c"
     break;
 
   case 472:
-#line 2377 "./util/configparser.y"
+#line 2380 "./util/configparser.y"
     { 
 		OUTYY(("P(low-rtt option is deprecated, use fast-server-num instead)\n"));
 		free((yyvsp[0].str));
 	}
-#line 5454 "util/configparser.c"
+#line 5457 "util/configparser.c"
     break;
 
   case 473:
-#line 2383 "./util/configparser.y"
+#line 2386 "./util/configparser.y"
     { 
 		OUTYY(("P(server_fast_server_num:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) <= 0)
@@ -5462,11 +5465,11 @@ yyreduce:
 		else cfg_parser->cfg->fast_server_num = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5466 "util/configparser.c"
+#line 5469 "util/configparser.c"
     break;
 
   case 474:
-#line 2392 "./util/configparser.y"
+#line 2395 "./util/configparser.y"
     { 
 		OUTYY(("P(server_fast_server_permil:%s)\n", (yyvsp[0].str))); 
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5474,11 +5477,11 @@ yyreduce:
 		else cfg_parser->cfg->fast_server_permil = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 5478 "util/configparser.c"
+#line 5481 "util/configparser.c"
     break;
 
   case 475:
-#line 2401 "./util/configparser.y"
+#line 2404 "./util/configparser.y"
     {
 		OUTYY(("P(server_qname_minimisation:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5487,11 +5490,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5491 "util/configparser.c"
+#line 5494 "util/configparser.c"
     break;
 
   case 476:
-#line 2411 "./util/configparser.y"
+#line 2414 "./util/configparser.y"
     {
 		OUTYY(("P(server_qname_minimisation_strict:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5500,11 +5503,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5504 "util/configparser.c"
+#line 5507 "util/configparser.c"
     break;
 
   case 477:
-#line 2421 "./util/configparser.y"
+#line 2424 "./util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_enabled:%s)\n", (yyvsp[0].str)));
@@ -5516,11 +5519,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 5520 "util/configparser.c"
+#line 5523 "util/configparser.c"
     break;
 
   case 478:
-#line 2434 "./util/configparser.y"
+#line 2437 "./util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_ignore_bogus:%s)\n", (yyvsp[0].str)));
@@ -5532,11 +5535,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 5536 "util/configparser.c"
+#line 5539 "util/configparser.c"
     break;
 
   case 479:
-#line 2447 "./util/configparser.y"
+#line 2450 "./util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_hook:%s)\n", (yyvsp[0].str)));
@@ -5547,11 +5550,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5551 "util/configparser.c"
+#line 5554 "util/configparser.c"
     break;
 
   case 480:
-#line 2459 "./util/configparser.y"
+#line 2462 "./util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_max_ttl:%s)\n", (yyvsp[0].str)));
@@ -5564,11 +5567,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5568 "util/configparser.c"
+#line 5571 "util/configparser.c"
     break;
 
   case 481:
-#line 2473 "./util/configparser.y"
+#line 2476 "./util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_whitelist:%s)\n", (yyvsp[0].str)));
@@ -5579,11 +5582,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5583 "util/configparser.c"
+#line 5586 "util/configparser.c"
     break;
 
   case 482:
-#line 2485 "./util/configparser.y"
+#line 2488 "./util/configparser.y"
     {
 	#ifdef USE_IPSECMOD
 		OUTYY(("P(server_ipsecmod_strict:%s)\n", (yyvsp[0].str)));
@@ -5596,11 +5599,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 5600 "util/configparser.c"
+#line 5603 "util/configparser.c"
     break;
 
   case 483:
-#line 2499 "./util/configparser.y"
+#line 2502 "./util/configparser.y"
     {
 		OUTYY(("P(server_edns_client_string:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(!cfg_str2list_insert(
@@ -5608,11 +5611,11 @@ yyreduce:
 			fatal_exit("out of memory adding "
 				"edns-client-string");
 	}
-#line 5612 "util/configparser.c"
+#line 5615 "util/configparser.c"
     break;
 
   case 484:
-#line 2508 "./util/configparser.y"
+#line 2511 "./util/configparser.y"
     {
 		OUTYY(("P(edns_client_string_opcode:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0 && strcmp((yyvsp[0].str), "0") != 0)
@@ -5623,11 +5626,11 @@ yyreduce:
 		free((yyvsp[0].str));
 
 	}
-#line 5627 "util/configparser.c"
+#line 5630 "util/configparser.c"
     break;
 
   case 485:
-#line 2520 "./util/configparser.y"
+#line 2523 "./util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->stubs->name)
@@ -5636,31 +5639,31 @@ yyreduce:
 		free(cfg_parser->cfg->stubs->name);
 		cfg_parser->cfg->stubs->name = (yyvsp[0].str);
 	}
-#line 5640 "util/configparser.c"
+#line 5643 "util/configparser.c"
     break;
 
   case 486:
-#line 2530 "./util/configparser.y"
+#line 2533 "./util/configparser.y"
     {
 		OUTYY(("P(stub-host:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->hosts, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5650 "util/configparser.c"
+#line 5653 "util/configparser.c"
     break;
 
   case 487:
-#line 2537 "./util/configparser.y"
+#line 2540 "./util/configparser.y"
     {
 		OUTYY(("P(stub-addr:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->addrs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5660 "util/configparser.c"
+#line 5663 "util/configparser.c"
     break;
 
   case 488:
-#line 2544 "./util/configparser.y"
+#line 2547 "./util/configparser.y"
     {
 		OUTYY(("P(stub-first:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5668,11 +5671,11 @@ yyreduce:
 		else cfg_parser->cfg->stubs->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5672 "util/configparser.c"
+#line 5675 "util/configparser.c"
     break;
 
   case 489:
-#line 2553 "./util/configparser.y"
+#line 2556 "./util/configparser.y"
     {
 		OUTYY(("P(stub-no-cache:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5680,11 +5683,11 @@ yyreduce:
 		else cfg_parser->cfg->stubs->no_cache=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5684 "util/configparser.c"
+#line 5687 "util/configparser.c"
     break;
 
   case 490:
-#line 2562 "./util/configparser.y"
+#line 2565 "./util/configparser.y"
     {
 		OUTYY(("P(stub-ssl-upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5693,11 +5696,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5697 "util/configparser.c"
+#line 5700 "util/configparser.c"
     break;
 
   case 491:
-#line 2572 "./util/configparser.y"
+#line 2575 "./util/configparser.y"
     {
 		OUTYY(("P(stub-prime:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5706,11 +5709,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5710 "util/configparser.c"
+#line 5713 "util/configparser.c"
     break;
 
   case 492:
-#line 2582 "./util/configparser.y"
+#line 2585 "./util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->forwards->name)
@@ -5719,31 +5722,31 @@ yyreduce:
 		free(cfg_parser->cfg->forwards->name);
 		cfg_parser->cfg->forwards->name = (yyvsp[0].str);
 	}
-#line 5723 "util/configparser.c"
+#line 5726 "util/configparser.c"
     break;
 
   case 493:
-#line 2592 "./util/configparser.y"
+#line 2595 "./util/configparser.y"
     {
 		OUTYY(("P(forward-host:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->hosts, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5733 "util/configparser.c"
+#line 5736 "util/configparser.c"
     break;
 
   case 494:
-#line 2599 "./util/configparser.y"
+#line 2602 "./util/configparser.y"
     {
 		OUTYY(("P(forward-addr:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->addrs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5743 "util/configparser.c"
+#line 5746 "util/configparser.c"
     break;
 
   case 495:
-#line 2606 "./util/configparser.y"
+#line 2609 "./util/configparser.y"
     {
 		OUTYY(("P(forward-first:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5751,11 +5754,11 @@ yyreduce:
 		else cfg_parser->cfg->forwards->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5755 "util/configparser.c"
+#line 5758 "util/configparser.c"
     break;
 
   case 496:
-#line 2615 "./util/configparser.y"
+#line 2618 "./util/configparser.y"
     {
 		OUTYY(("P(forward-no-cache:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5763,11 +5766,11 @@ yyreduce:
 		else cfg_parser->cfg->forwards->no_cache=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5767 "util/configparser.c"
+#line 5770 "util/configparser.c"
     break;
 
   case 497:
-#line 2624 "./util/configparser.y"
+#line 2627 "./util/configparser.y"
     {
 		OUTYY(("P(forward-ssl-upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5776,11 +5779,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5780 "util/configparser.c"
+#line 5783 "util/configparser.c"
     break;
 
   case 498:
-#line 2634 "./util/configparser.y"
+#line 2637 "./util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->auths->name)
@@ -5789,52 +5792,52 @@ yyreduce:
 		free(cfg_parser->cfg->auths->name);
 		cfg_parser->cfg->auths->name = (yyvsp[0].str);
 	}
-#line 5793 "util/configparser.c"
+#line 5796 "util/configparser.c"
     break;
 
   case 499:
-#line 2644 "./util/configparser.y"
+#line 2647 "./util/configparser.y"
     {
 		OUTYY(("P(zonefile:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->auths->zonefile);
 		cfg_parser->cfg->auths->zonefile = (yyvsp[0].str);
 	}
-#line 5803 "util/configparser.c"
+#line 5806 "util/configparser.c"
     break;
 
   case 500:
-#line 2651 "./util/configparser.y"
+#line 2654 "./util/configparser.y"
     {
 		OUTYY(("P(master:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->auths->masters, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5813 "util/configparser.c"
+#line 5816 "util/configparser.c"
     break;
 
   case 501:
-#line 2658 "./util/configparser.y"
+#line 2661 "./util/configparser.y"
     {
 		OUTYY(("P(url:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->auths->urls, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5823 "util/configparser.c"
+#line 5826 "util/configparser.c"
     break;
 
   case 502:
-#line 2665 "./util/configparser.y"
+#line 2668 "./util/configparser.y"
     {
 		OUTYY(("P(allow-notify:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->auths->allow_notify,
 			(yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 5834 "util/configparser.c"
+#line 5837 "util/configparser.c"
     break;
 
   case 503:
-#line 2673 "./util/configparser.y"
+#line 2676 "./util/configparser.y"
     {
 		OUTYY(("P(for-downstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5843,11 +5846,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5847 "util/configparser.c"
+#line 5850 "util/configparser.c"
     break;
 
   case 504:
-#line 2683 "./util/configparser.y"
+#line 2686 "./util/configparser.y"
     {
 		OUTYY(("P(for-upstream:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5856,11 +5859,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5860 "util/configparser.c"
+#line 5863 "util/configparser.c"
     break;
 
   case 505:
-#line 2693 "./util/configparser.y"
+#line 2696 "./util/configparser.y"
     {
 		OUTYY(("P(fallback-enabled:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5869,11 +5872,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5873 "util/configparser.c"
+#line 5876 "util/configparser.c"
     break;
 
   case 506:
-#line 2703 "./util/configparser.y"
+#line 2706 "./util/configparser.y"
     {
 		OUTYY(("P(name:%s)\n", (yyvsp[0].str)));
 		if(cfg_parser->cfg->views->name)
@@ -5882,11 +5885,11 @@ yyreduce:
 		free(cfg_parser->cfg->views->name);
 		cfg_parser->cfg->views->name = (yyvsp[0].str);
 	}
-#line 5886 "util/configparser.c"
+#line 5889 "util/configparser.c"
     break;
 
   case 507:
-#line 2713 "./util/configparser.y"
+#line 2716 "./util/configparser.y"
     {
 		OUTYY(("P(view_local_zone:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "static")!=0 && strcmp((yyvsp[0].str), "deny")!=0 &&
@@ -5924,11 +5927,11 @@ yyreduce:
 				fatal_exit("out of memory adding local-zone");
 		}
 	}
-#line 5928 "util/configparser.c"
+#line 5931 "util/configparser.c"
     break;
 
   case 508:
-#line 2752 "./util/configparser.y"
+#line 2755 "./util/configparser.y"
     {
 		OUTYY(("P(view_response_ip:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		validate_respip_action((yyvsp[0].str));
@@ -5937,33 +5940,33 @@ yyreduce:
 			fatal_exit("out of memory adding per-view "
 				"response-ip action");
 	}
-#line 5941 "util/configparser.c"
+#line 5944 "util/configparser.c"
     break;
 
   case 509:
-#line 2762 "./util/configparser.y"
+#line 2765 "./util/configparser.y"
     {
 		OUTYY(("P(view_response_ip_data:%s)\n", (yyvsp[-1].str)));
 		if(!cfg_str2list_insert(
 			&cfg_parser->cfg->views->respip_data, (yyvsp[-1].str), (yyvsp[0].str)))
 			fatal_exit("out of memory adding response-ip-data");
 	}
-#line 5952 "util/configparser.c"
+#line 5955 "util/configparser.c"
     break;
 
   case 510:
-#line 2770 "./util/configparser.y"
+#line 2773 "./util/configparser.y"
     {
 		OUTYY(("P(view_local_data:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->views->local_data, (yyvsp[0].str))) {
 			fatal_exit("out of memory adding local-data");
 		}
 	}
-#line 5963 "util/configparser.c"
+#line 5966 "util/configparser.c"
     break;
 
   case 511:
-#line 2778 "./util/configparser.y"
+#line 2781 "./util/configparser.y"
     {
 		char* ptr;
 		OUTYY(("P(view_local_data_ptr:%s)\n", (yyvsp[0].str)));
@@ -5977,11 +5980,11 @@ yyreduce:
 			yyerror("local-data-ptr could not be reversed");
 		}
 	}
-#line 5981 "util/configparser.c"
+#line 5984 "util/configparser.c"
     break;
 
   case 512:
-#line 2793 "./util/configparser.y"
+#line 2796 "./util/configparser.y"
     {
 		OUTYY(("P(view-first:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -5989,19 +5992,19 @@ yyreduce:
 		else cfg_parser->cfg->views->isfirst=(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 5993 "util/configparser.c"
+#line 5996 "util/configparser.c"
     break;
 
   case 513:
-#line 2802 "./util/configparser.y"
+#line 2805 "./util/configparser.y"
     { 
 		OUTYY(("\nP(remote-control:)\n")); 
 	}
-#line 6001 "util/configparser.c"
+#line 6004 "util/configparser.c"
     break;
 
   case 524:
-#line 2813 "./util/configparser.y"
+#line 2816 "./util/configparser.y"
     {
 		OUTYY(("P(control_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6010,11 +6013,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6014 "util/configparser.c"
+#line 6017 "util/configparser.c"
     break;
 
   case 525:
-#line 2823 "./util/configparser.y"
+#line 2826 "./util/configparser.y"
     {
 		OUTYY(("P(control_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -6022,79 +6025,79 @@ yyreduce:
 		else cfg_parser->cfg->control_port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 6026 "util/configparser.c"
+#line 6029 "util/configparser.c"
     break;
 
   case 526:
-#line 2832 "./util/configparser.y"
+#line 2835 "./util/configparser.y"
     {
 		OUTYY(("P(control_interface:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_append(&cfg_parser->cfg->control_ifs, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 6036 "util/configparser.c"
+#line 6039 "util/configparser.c"
     break;
 
   case 527:
-#line 2839 "./util/configparser.y"
+#line 2842 "./util/configparser.y"
     {
 		OUTYY(("P(control_use_cert:%s)\n", (yyvsp[0].str)));
 		cfg_parser->cfg->control_use_cert = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6046 "util/configparser.c"
+#line 6049 "util/configparser.c"
     break;
 
   case 528:
-#line 2846 "./util/configparser.y"
+#line 2849 "./util/configparser.y"
     {
 		OUTYY(("P(rc_server_key_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->server_key_file);
 		cfg_parser->cfg->server_key_file = (yyvsp[0].str);
 	}
-#line 6056 "util/configparser.c"
+#line 6059 "util/configparser.c"
     break;
 
   case 529:
-#line 2853 "./util/configparser.y"
+#line 2856 "./util/configparser.y"
     {
 		OUTYY(("P(rc_server_cert_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->server_cert_file);
 		cfg_parser->cfg->server_cert_file = (yyvsp[0].str);
 	}
-#line 6066 "util/configparser.c"
+#line 6069 "util/configparser.c"
     break;
 
   case 530:
-#line 2860 "./util/configparser.y"
+#line 2863 "./util/configparser.y"
     {
 		OUTYY(("P(rc_control_key_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->control_key_file);
 		cfg_parser->cfg->control_key_file = (yyvsp[0].str);
 	}
-#line 6076 "util/configparser.c"
+#line 6079 "util/configparser.c"
     break;
 
   case 531:
-#line 2867 "./util/configparser.y"
+#line 2870 "./util/configparser.y"
     {
 		OUTYY(("P(rc_control_cert_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->control_cert_file);
 		cfg_parser->cfg->control_cert_file = (yyvsp[0].str);
 	}
-#line 6086 "util/configparser.c"
+#line 6089 "util/configparser.c"
     break;
 
   case 532:
-#line 2874 "./util/configparser.y"
+#line 2877 "./util/configparser.y"
     {
 		OUTYY(("\nP(dnstap:)\n"));
 	}
-#line 6094 "util/configparser.c"
+#line 6097 "util/configparser.c"
     break;
 
   case 554:
-#line 2894 "./util/configparser.y"
+#line 2897 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6102,11 +6105,11 @@ yyreduce:
 		else cfg_parser->cfg->dnstap = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6106 "util/configparser.c"
+#line 6109 "util/configparser.c"
     break;
 
   case 555:
-#line 2903 "./util/configparser.y"
+#line 2906 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_bidirectional:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6115,31 +6118,31 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6119 "util/configparser.c"
+#line 6122 "util/configparser.c"
     break;
 
   case 556:
-#line 2913 "./util/configparser.y"
+#line 2916 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_socket_path:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_socket_path);
 		cfg_parser->cfg->dnstap_socket_path = (yyvsp[0].str);
 	}
-#line 6129 "util/configparser.c"
+#line 6132 "util/configparser.c"
     break;
 
   case 557:
-#line 2920 "./util/configparser.y"
+#line 2923 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_ip:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_ip);
 		cfg_parser->cfg->dnstap_ip = (yyvsp[0].str);
 	}
-#line 6139 "util/configparser.c"
+#line 6142 "util/configparser.c"
     break;
 
   case 558:
-#line 2927 "./util/configparser.y"
+#line 2930 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_tls:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6147,51 +6150,51 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_tls = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6151 "util/configparser.c"
+#line 6154 "util/configparser.c"
     break;
 
   case 559:
-#line 2936 "./util/configparser.y"
+#line 2939 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_tls_server_name:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_tls_server_name);
 		cfg_parser->cfg->dnstap_tls_server_name = (yyvsp[0].str);
 	}
-#line 6161 "util/configparser.c"
+#line 6164 "util/configparser.c"
     break;
 
   case 560:
-#line 2943 "./util/configparser.y"
+#line 2946 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_tls_cert_bundle:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_tls_cert_bundle);
 		cfg_parser->cfg->dnstap_tls_cert_bundle = (yyvsp[0].str);
 	}
-#line 6171 "util/configparser.c"
+#line 6174 "util/configparser.c"
     break;
 
   case 561:
-#line 2950 "./util/configparser.y"
+#line 2953 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_tls_client_key_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_tls_client_key_file);
 		cfg_parser->cfg->dnstap_tls_client_key_file = (yyvsp[0].str);
 	}
-#line 6181 "util/configparser.c"
+#line 6184 "util/configparser.c"
     break;
 
   case 562:
-#line 2957 "./util/configparser.y"
+#line 2960 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_tls_client_cert_file:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_tls_client_cert_file);
 		cfg_parser->cfg->dnstap_tls_client_cert_file = (yyvsp[0].str);
 	}
-#line 6191 "util/configparser.c"
+#line 6194 "util/configparser.c"
     break;
 
   case 563:
-#line 2964 "./util/configparser.y"
+#line 2967 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_send_identity:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6199,11 +6202,11 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_send_identity = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6203 "util/configparser.c"
+#line 6206 "util/configparser.c"
     break;
 
   case 564:
-#line 2973 "./util/configparser.y"
+#line 2976 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_send_version:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6211,31 +6214,31 @@ yyreduce:
 		else cfg_parser->cfg->dnstap_send_version = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6215 "util/configparser.c"
+#line 6218 "util/configparser.c"
     break;
 
   case 565:
-#line 2982 "./util/configparser.y"
+#line 2985 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_identity:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_identity);
 		cfg_parser->cfg->dnstap_identity = (yyvsp[0].str);
 	}
-#line 6225 "util/configparser.c"
+#line 6228 "util/configparser.c"
     break;
 
   case 566:
-#line 2989 "./util/configparser.y"
+#line 2992 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_version:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnstap_version);
 		cfg_parser->cfg->dnstap_version = (yyvsp[0].str);
 	}
-#line 6235 "util/configparser.c"
+#line 6238 "util/configparser.c"
     break;
 
   case 567:
-#line 2996 "./util/configparser.y"
+#line 2999 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_resolver_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6244,11 +6247,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6248 "util/configparser.c"
+#line 6251 "util/configparser.c"
     break;
 
   case 568:
-#line 3006 "./util/configparser.y"
+#line 3009 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_resolver_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6257,11 +6260,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6261 "util/configparser.c"
+#line 6264 "util/configparser.c"
     break;
 
   case 569:
-#line 3016 "./util/configparser.y"
+#line 3019 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_client_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6270,11 +6273,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6274 "util/configparser.c"
+#line 6277 "util/configparser.c"
     break;
 
   case 570:
-#line 3026 "./util/configparser.y"
+#line 3029 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_client_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6283,11 +6286,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6287 "util/configparser.c"
+#line 6290 "util/configparser.c"
     break;
 
   case 571:
-#line 3036 "./util/configparser.y"
+#line 3039 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_forwarder_query_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6296,11 +6299,11 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6300 "util/configparser.c"
+#line 6303 "util/configparser.c"
     break;
 
   case 572:
-#line 3046 "./util/configparser.y"
+#line 3049 "./util/configparser.y"
     {
 		OUTYY(("P(dt_dnstap_log_forwarder_response_messages:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6309,47 +6312,47 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6313 "util/configparser.c"
+#line 6316 "util/configparser.c"
     break;
 
   case 573:
-#line 3056 "./util/configparser.y"
+#line 3059 "./util/configparser.y"
     { 
 		OUTYY(("\nP(python:)\n")); 
 	}
-#line 6321 "util/configparser.c"
+#line 6324 "util/configparser.c"
     break;
 
   case 577:
-#line 3065 "./util/configparser.y"
+#line 3068 "./util/configparser.y"
     {
 		OUTYY(("P(python-script:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_append_ex(&cfg_parser->cfg->python_script, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 6331 "util/configparser.c"
+#line 6334 "util/configparser.c"
     break;
 
   case 578:
-#line 3071 "./util/configparser.y"
+#line 3074 "./util/configparser.y"
     { 
 		OUTYY(("\nP(dynlib:)\n")); 
 	}
-#line 6339 "util/configparser.c"
+#line 6342 "util/configparser.c"
     break;
 
   case 582:
-#line 3080 "./util/configparser.y"
+#line 3083 "./util/configparser.y"
     {
 		OUTYY(("P(dynlib-file:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_append_ex(&cfg_parser->cfg->dynlib_file, (yyvsp[0].str)))
 			yyerror("out of memory");
 	}
-#line 6349 "util/configparser.c"
+#line 6352 "util/configparser.c"
     break;
 
   case 583:
-#line 3086 "./util/configparser.y"
+#line 3089 "./util/configparser.y"
     {
 		OUTYY(("P(disable_dnssec_lame_check:%s)\n", (yyvsp[0].str)));
 		if (strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6358,21 +6361,21 @@ yyreduce:
 			(strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6362 "util/configparser.c"
+#line 6365 "util/configparser.c"
     break;
 
   case 584:
-#line 3096 "./util/configparser.y"
+#line 3099 "./util/configparser.y"
     {
 		OUTYY(("P(server_log_identity:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->log_identity);
 		cfg_parser->cfg->log_identity = (yyvsp[0].str);
 	}
-#line 6372 "util/configparser.c"
+#line 6375 "util/configparser.c"
     break;
 
   case 585:
-#line 3103 "./util/configparser.y"
+#line 3106 "./util/configparser.y"
     {
 		OUTYY(("P(server_response_ip:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		validate_respip_action((yyvsp[0].str));
@@ -6380,30 +6383,30 @@ yyreduce:
 			(yyvsp[-1].str), (yyvsp[0].str)))
 			fatal_exit("out of memory adding response-ip");
 	}
-#line 6384 "util/configparser.c"
+#line 6387 "util/configparser.c"
     break;
 
   case 586:
-#line 3112 "./util/configparser.y"
+#line 3115 "./util/configparser.y"
     {
 		OUTYY(("P(server_response_ip_data:%s)\n", (yyvsp[-1].str)));
 		if(!cfg_str2list_insert(&cfg_parser->cfg->respip_data,
 			(yyvsp[-1].str), (yyvsp[0].str)))
 			fatal_exit("out of memory adding response-ip-data");
 	}
-#line 6395 "util/configparser.c"
+#line 6398 "util/configparser.c"
     break;
 
   case 587:
-#line 3120 "./util/configparser.y"
+#line 3123 "./util/configparser.y"
     {
 		OUTYY(("\nP(dnscrypt:)\n"));
 	}
-#line 6403 "util/configparser.c"
+#line 6406 "util/configparser.c"
     break;
 
   case 600:
-#line 3136 "./util/configparser.y"
+#line 3139 "./util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_enable:%s)\n", (yyvsp[0].str)));
 		if(strcmp((yyvsp[0].str), "yes") != 0 && strcmp((yyvsp[0].str), "no") != 0)
@@ -6411,11 +6414,11 @@ yyreduce:
 		else cfg_parser->cfg->dnscrypt = (strcmp((yyvsp[0].str), "yes")==0);
 		free((yyvsp[0].str));
 	}
-#line 6415 "util/configparser.c"
+#line 6418 "util/configparser.c"
     break;
 
   case 601:
-#line 3146 "./util/configparser.y"
+#line 3149 "./util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_port:%s)\n", (yyvsp[0].str)));
 		if(atoi((yyvsp[0].str)) == 0)
@@ -6423,21 +6426,21 @@ yyreduce:
 		else cfg_parser->cfg->dnscrypt_port = atoi((yyvsp[0].str));
 		free((yyvsp[0].str));
 	}
-#line 6427 "util/configparser.c"
+#line 6430 "util/configparser.c"
     break;
 
   case 602:
-#line 3155 "./util/configparser.y"
+#line 3158 "./util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_provider:%s)\n", (yyvsp[0].str)));
 		free(cfg_parser->cfg->dnscrypt_provider);
 		cfg_parser->cfg->dnscrypt_provider = (yyvsp[0].str);
 	}
-#line 6437 "util/configparser.c"
+#line 6440 "util/configparser.c"
     break;
 
   case 603:
-#line 3162 "./util/configparser.y"
+#line 3165 "./util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_provider_cert:%s)\n", (yyvsp[0].str)));
 		if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_provider_cert, (yyvsp[0].str)))
@@ -6445,21 +6448,21 @@ yyreduce:
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_provider_cert, (yyvsp[0].str)))
 			fatal_exit("out of memory adding dnscrypt-provider-cert");
 	}
-#line 6449 "util/configparser.c"
+#line 6452 "util/configparser.c"
     break;
 
   case 604:
-#line 3171 "./util/configparser.y"
+#line 3174 "./util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_provider_cert_rotated:%s)\n", (yyvsp[0].str)));
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_provider_cert_rotated, (yyvsp[0].str)))
 			fatal_exit("out of memory adding dnscrypt-provider-cert-rotated");
 	}
-#line 6459 "util/configparser.c"
+#line 6462 "util/configparser.c"
     break;
 
   case 605:
-#line 3178 "./util/configparser.y"
+#line 3181 "./util/configparser.y"
     {
 		OUTYY(("P(dnsc_dnscrypt_secret_key:%s)\n", (yyvsp[0].str)));
 		if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_secret_key, (yyvsp[0].str)))
@@ -6467,22 +6470,22 @@ yyreduce:
 		if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_secret_key, (yyvsp[0].str)))
 			fatal_exit("out of memory adding dnscrypt-secret-key");
 	}
-#line 6471 "util/configparser.c"
+#line 6474 "util/configparser.c"
     break;
 
   case 606:
-#line 3187 "./util/configparser.y"
+#line 3190 "./util/configparser.y"
     {
   	OUTYY(("P(dnscrypt_shared_secret_cache_size:%s)\n", (yyvsp[0].str)));
   	if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->dnscrypt_shared_secret_cache_size))
   		yyerror("memory size expected");
   	free((yyvsp[0].str));
   }
-#line 6482 "util/configparser.c"
+#line 6485 "util/configparser.c"
     break;
 
   case 607:
-#line 3195 "./util/configparser.y"
+#line 3198 "./util/configparser.y"
     {
   	OUTYY(("P(dnscrypt_shared_secret_cache_slabs:%s)\n", (yyvsp[0].str)));
   	if(atoi((yyvsp[0].str)) == 0)
@@ -6494,22 +6497,22 @@ yyreduce:
   	}
   	free((yyvsp[0].str));
   }
-#line 6498 "util/configparser.c"
+#line 6501 "util/configparser.c"
     break;
 
   case 608:
-#line 3208 "./util/configparser.y"
+#line 3211 "./util/configparser.y"
     {
   	OUTYY(("P(dnscrypt_nonce_cache_size:%s)\n", (yyvsp[0].str)));
   	if(!cfg_parse_memsize((yyvsp[0].str), &cfg_parser->cfg->dnscrypt_nonce_cache_size))
   		yyerror("memory size expected");
   	free((yyvsp[0].str));
   }
-#line 6509 "util/configparser.c"
+#line 6512 "util/configparser.c"
     break;
 
   case 609:
-#line 3216 "./util/configparser.y"
+#line 3219 "./util/configparser.y"
     {
   	OUTYY(("P(dnscrypt_nonce_cache_slabs:%s)\n", (yyvsp[0].str)));
   	if(atoi((yyvsp[0].str)) == 0)
@@ -6521,19 +6524,19 @@ yyreduce:
   	}
   	free((yyvsp[0].str));
   }
-#line 6525 "util/configparser.c"
+#line 6528 "util/configparser.c"
     break;
 
   case 610:
-#line 3229 "./util/configparser.y"
+#line 3232 "./util/configparser.y"
     {
 		OUTYY(("\nP(cachedb:)\n"));
 	}
-#line 6533 "util/configparser.c"
+#line 6536 "util/configparser.c"
     break;
 
   case 619:
-#line 3240 "./util/configparser.y"
+#line 3243 "./util/configparser.y"
     {
 	#ifdef USE_CACHEDB
 		OUTYY(("P(backend:%s)\n", (yyvsp[0].str)));
@@ -6544,11 +6547,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 6548 "util/configparser.c"
+#line 6551 "util/configparser.c"
     break;
 
   case 620:
-#line 3252 "./util/configparser.y"
+#line 3255 "./util/configparser.y"
     {
 	#ifdef USE_CACHEDB
 		OUTYY(("P(secret-seed:%s)\n", (yyvsp[0].str)));
@@ -6559,11 +6562,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 6563 "util/configparser.c"
+#line 6566 "util/configparser.c"
     break;
 
   case 621:
-#line 3264 "./util/configparser.y"
+#line 3267 "./util/configparser.y"
     {
 	#if defined(USE_CACHEDB) && defined(USE_REDIS)
 		OUTYY(("P(redis_server_host:%s)\n", (yyvsp[0].str)));
@@ -6574,11 +6577,11 @@ yyreduce:
 		free((yyvsp[0].str));
 	#endif
 	}
-#line 6578 "util/configparser.c"
+#line 6581 "util/configparser.c"
     break;
 
   case 622:
-#line 3276 "./util/configparser.y"
+#line 3279 "./util/configparser.y"
     {
 	#if defined(USE_CACHEDB) && defined(USE_REDIS)
 		int port;
@@ -6592,11 +6595,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 6596 "util/configparser.c"
+#line 6599 "util/configparser.c"
     break;
 
   case 623:
-#line 3291 "./util/configparser.y"
+#line 3294 "./util/configparser.y"
     {
 	#if defined(USE_CACHEDB) && defined(USE_REDIS)
 		OUTYY(("P(redis_timeout:%s)\n", (yyvsp[0].str)));
@@ -6608,11 +6611,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 6612 "util/configparser.c"
+#line 6615 "util/configparser.c"
     break;
 
   case 624:
-#line 3304 "./util/configparser.y"
+#line 3307 "./util/configparser.y"
     {
 	#if defined(USE_CACHEDB) && defined(USE_REDIS)
 		OUTYY(("P(redis_expire_records:%s)\n", (yyvsp[0].str)));
@@ -6624,11 +6627,11 @@ yyreduce:
 	#endif
 		free((yyvsp[0].str));
 	}
-#line 6628 "util/configparser.c"
+#line 6631 "util/configparser.c"
     break;
 
   case 625:
-#line 3317 "./util/configparser.y"
+#line 3320 "./util/configparser.y"
     {
 		OUTYY(("P(server_tcp_connection_limit:%s %s)\n", (yyvsp[-1].str), (yyvsp[0].str)));
 		if (atoi((yyvsp[0].str)) < 0)
@@ -6638,19 +6641,19 @@ yyreduce:
 				fatal_exit("out of memory adding tcp connection limit");
 		}
 	}
-#line 6642 "util/configparser.c"
+#line 6645 "util/configparser.c"
     break;
 
   case 626:
-#line 3328 "./util/configparser.y"
+#line 3331 "./util/configparser.y"
     {
 			OUTYY(("\nP(ipset:)\n"));
 		}
-#line 6650 "util/configparser.c"
+#line 6653 "util/configparser.c"
     break;
 
   case 631:
-#line 3337 "./util/configparser.y"
+#line 3340 "./util/configparser.y"
     {
 		#ifdef USE_IPSET
 			OUTYY(("P(name-v4:%s)\n", (yyvsp[0].str)));
@@ -6664,11 +6667,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		#endif
 		}
-#line 6668 "util/configparser.c"
+#line 6671 "util/configparser.c"
     break;
 
   case 632:
-#line 3352 "./util/configparser.y"
+#line 3355 "./util/configparser.y"
     {
 		#ifdef USE_IPSET
 			OUTYY(("P(name-v6:%s)\n", (yyvsp[0].str)));
@@ -6682,11 +6685,11 @@ yyreduce:
 			free((yyvsp[0].str));
 		#endif
 		}
-#line 6686 "util/configparser.c"
+#line 6689 "util/configparser.c"
     break;
 
 
-#line 6690 "util/configparser.c"
+#line 6693 "util/configparser.c"
 
       default: break;
     }
@@ -6918,7 +6921,7 @@ yyreturn:
 #endif
   return yyresult;
 }
-#line 3366 "./util/configparser.y"
+#line 3369 "./util/configparser.y"
 
 
 /* parse helper routines could be here */
diff --git a/util/configparser.y b/util/configparser.y
index cc965a477..32419593a 100644
--- a/util/configparser.y
+++ b/util/configparser.y
@@ -2030,6 +2030,8 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
 		   && strcmp($3, "always_transparent")!=0
 		   && strcmp($3, "always_refuse")!=0
 		   && strcmp($3, "always_nxdomain")!=0
+		   && strcmp($3, "always_nodata")!=0
+		   && strcmp($3, "always_deny")!=0
 		   && strcmp($3, "always_null")!=0
 		   && strcmp($3, "noview")!=0
 		   && strcmp($3, "inform")!=0 && strcmp($3, "inform_deny")!=0
@@ -2039,7 +2041,8 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
 				"refuse, redirect, transparent, "
 				"typetransparent, inform, inform_deny, "
 				"inform_redirect, always_transparent, "
-				"always_refuse, always_nxdomain, always_null, "
+				"always_refuse, always_nxdomain, "
+				"always_nodata, always_deny, always_null, "
 				"noview, nodefault or ipset");
 			free($2);
 			free($3);

From 4d1d8b4cddfde95d50bf3a4f5dcfe36f652c2f58 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Tue, 12 Jan 2021 13:40:45 +0100
Subject: [PATCH 35/44] And man page documentation for them.

---
 doc/unbound.conf.5.in | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 4eeb41bf9..e7964d969 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -1305,6 +1305,12 @@ Like refuse, but ignores local data and refuses the query.
 \h'5'\fIalways_nxdomain\fR
 Like static, but ignores local data and returns nxdomain for the query.
 .TP 10
+\h'5'\fIalways_nodata\fR
+Like static, but ignores local data and returns nodata for the query.
+.TP 10
+\h'5'\fIalways_deny\fR
+Like deny, but ignores local data and drops the query.
+.TP 10
 \h'5'\fIalways_null\fR
 Always returns 0.0.0.0 or ::0 for every name in the zone.  Like redirect
 with zero data for A and AAAA.  Ignores local data in the zone.  Used for

From 93e5705259d4ebc4131b46ffee4e68163d171f04 Mon Sep 17 00:00:00 2001
From: xiangbao227 <1004129700@qq.com>
Date: Wed, 13 Jan 2021 10:33:41 +0800
Subject: [PATCH 36/44] I found that in function lruhash_remove, table was
 locked at first ,then lru_remove the entry , then unlock the table, and then
 markdel entry , but in function rrset_cache_touch , the entry will be touched
 to lru again before markdelling entry in function lruhash_remove. This is a
 bug!

---
 util/storage/lruhash.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/util/storage/lruhash.c b/util/storage/lruhash.c
index 0003ff491..3500a4ef0 100644
--- a/util/storage/lruhash.c
+++ b/util/storage/lruhash.c
@@ -398,13 +398,13 @@ lruhash_remove(struct lruhash* table, hashvalue_type hash, void* key)
 		return;
 	}
 	table->num--;
-	table->space_used -= (*table->sizefunc)(entry->key, entry->data);
-	lock_quick_unlock(&table->lock);
+	table->space_used -= (*table->sizefunc)(entry->key, entry->data);	
 	lock_rw_wrlock(&entry->lock);
 	if(table->markdelfunc)
 		(*table->markdelfunc)(entry->key);
 	lock_rw_unlock(&entry->lock);
 	lock_quick_unlock(&bin->lock);
+	lock_quick_unlock(&table->lock);
 	/* finish removal */
 	d = entry->data;
 	(*table->delkeyfunc)(entry->key, table->cb_arg);

From 24fd871245b7520f23dcfdcbf420de1798c12cdf Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Wed, 13 Jan 2021 10:07:15 +0100
Subject: [PATCH 37/44] Changelog note for #399 - Merge #399 from xiangbao227:
 The function rrset_cache_touch can   touch an entry to the lru while
 markdelling the entry in   lruhash_remove.

---
 doc/Changelog | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/doc/Changelog b/doc/Changelog
index b9d449371..c57e43179 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,8 @@
+13 January 2021: Wouter
+	- Merge #399 from xiangbao227: The function rrset_cache_touch can
+	  touch an entry to the lru while markdelling the entry in
+	  lruhash_remove.
+
 12 January 2021: Wouter
 	- Fix #397: [Feature request] add new type always_null to local-zone
 	  similar to always_nxdomain.

From 5314f633430b87816038531aeb903eeb302fc505 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Wed, 13 Jan 2021 10:10:12 +0100
Subject: [PATCH 38/44] Nicer changelog note for #399 - Merge #399 from
 xiangbao227: The lock of lruhash table should   unlocked after markdel entry.

---
 doc/Changelog | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/doc/Changelog b/doc/Changelog
index c57e43179..ce922f6fc 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,7 +1,6 @@
 13 January 2021: Wouter
-	- Merge #399 from xiangbao227: The function rrset_cache_touch can
-	  touch an entry to the lru while markdelling the entry in
-	  lruhash_remove.
+	- Merge #399 from xiangbao227: The lock of lruhash table should
+	  unlocked after markdel entry.
 
 12 January 2021: Wouter
 	- Fix #397: [Feature request] add new type always_null to local-zone

From 3b82e690efc83a96c9e559750fc4576034ad2ea7 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Wed, 13 Jan 2021 14:56:25 +0100
Subject: [PATCH 39/44] - Fix for #93: dynlibmodule link fix for Windows.

---
 Makefile.in   | 24 ++++++++++++------------
 doc/Changelog |  1 +
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/Makefile.in b/Makefile.in
index 4ca46496b..99943a650 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -349,10 +349,10 @@ unbound$(EXEEXT):	$(DAEMON_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(DAEMON_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
 
 unbound-checkconf$(EXEEXT):	$(CHECKCONF_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(CHECKCONF_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
+	$(LINK) -o $@ $(CHECKCONF_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
 
 unbound-control$(EXEEXT):	$(CONTROL_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(CONTROL_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
+	$(LINK) -o $@ $(CONTROL_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
 
 unbound-host$(EXEEXT):	$(HOST_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(HOST_OBJ_LINK) -L. -L.libs -lunbound $(SSLLIB) $(LIBS)
@@ -370,37 +370,37 @@ anchor-update$(EXEEXT):  $(ANCHORUPD_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(ANCHORUPD_OBJ_LINK) -L. -L.libs -lunbound $(LIBS)
 
 unittest$(EXEEXT):	$(UNITTEST_OBJ_LINK)
-	$(LINK) -o $@ $(UNITTEST_OBJ_LINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
+	$(LINK) -o $@ $(UNITTEST_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 testbound$(EXEEXT):	$(TESTBOUND_OBJ_LINK)
-	$(LINK) -o $@ $(TESTBOUND_OBJ_LINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
+	$(LINK) -o $@ $(TESTBOUND_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 lock-verify$(EXEEXT):	$(LOCKVERIFY_OBJ_LINK)
-	$(LINK) -o $@ $(LOCKVERIFY_OBJ_LINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
+	$(LINK) -o $@ $(LOCKVERIFY_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 petal$(EXEEXT):	$(PETAL_OBJ_LINK)
 	$(LINK) -o $@ $(PETAL_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 pktview$(EXEEXT):	$(PKTVIEW_OBJ_LINK)
-	$(LINK) -o $@ $(PKTVIEW_OBJ_LINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
+	$(LINK) -o $@ $(PKTVIEW_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 memstats$(EXEEXT):	$(MEMSTATS_OBJ_LINK)
-	$(LINK) -o $@ $(MEMSTATS_OBJ_LINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
+	$(LINK) -o $@ $(MEMSTATS_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 asynclook$(EXEEXT):	$(ASYNCLOOK_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(ASYNCLOOK_OBJ_LINK) -L. -L.libs -lunbound $(SSLLIB) $(LIBS)
 
 streamtcp$(EXEEXT):	$(STREAMTCP_OBJ_LINK)
-	$(LINK) -o $@ $(STREAMTCP_OBJ_LINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
+	$(LINK) -o $@ $(STREAMTCP_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 dohclient$(EXEEXT):	$(DOHCLIENT_OBJ_LINK)
-	$(LINK) -o $@ $(DOHCLIENT_OBJ_LINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
+	$(LINK) -o $@ $(DOHCLIENT_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 perf$(EXEEXT):	$(PERF_OBJ_LINK)
-	$(LINK) -o $@ $(PERF_OBJ_LINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
+	$(LINK) -o $@ $(PERF_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 delayer$(EXEEXT):	$(DELAYER_OBJ_LINK)
-	$(LINK) -o $@ $(DELAYER_OBJ_LINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
+	$(LINK) -o $@ $(DELAYER_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 signit$(EXEEXT):	testcode/signit.c
 	$(CC) $(CPPFLAGS) $(CFLAGS) @PTHREAD_CFLAGS_ONLY@ -o $@ testcode/signit.c $(LDFLAGS) -lldns $(SSLLIB) $(LIBS)
@@ -423,7 +423,7 @@ dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h: $(srcdir)/dnstap/dnstap.proto
 	$(PROTOC_C) --c_out=. --proto_path=$(srcdir) $(srcdir)/dnstap/dnstap.proto
 
 unbound-dnstap-socket$(EXEEXT):	$(DNSTAP_SOCKET_OBJ_LINK)
-	$(LINK) -o $@ $(DNSTAP_SOCKET_OBJ_LINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
+	$(LINK) -o $@ $(DNSTAP_SOCKET_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 dnstap.pb-c.lo dnstap.pb-c.o: dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h
 dtstream.lo dtstream.o: $(srcdir)/dnstap/dtstream.c config.h $(srcdir)/dnstap/dtstream.h
diff --git a/doc/Changelog b/doc/Changelog
index ce922f6fc..c3223b05a 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,7 @@
 13 January 2021: Wouter
 	- Merge #399 from xiangbao227: The lock of lruhash table should
 	  unlocked after markdel entry.
+	- Fix for #93: dynlibmodule link fix for Windows.
 
 12 January 2021: Wouter
 	- Fix #397: [Feature request] add new type always_null to local-zone

From 4613d2bf047857442c63d8f9177cda91b82e84e0 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Thu, 14 Jan 2021 16:50:17 +0100
Subject: [PATCH 40/44] - Fix for #93: dynlibmodule import library is named
 libunbound.dll.a.

---
 configure                       | 2 +-
 configure.ac                    | 2 +-
 doc/Changelog                   | 3 +++
 dynlibmod/examples/helloworld.c | 6 ++++--
 4 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/configure b/configure
index 87959deae..7957f0dd6 100755
--- a/configure
+++ b/configure
@@ -17237,7 +17237,7 @@ $as_echo "#define WITH_DYNLIBMODULE 1" >>confdefs.h
   if test $on_mingw = "no"; then
     DYNLIBMOD_EXTRALIBS="-ldl -export-dynamic"
   else
-    DYNLIBMOD_EXTRALIBS="-Wl,--export-all-symbols,--out-implib,libunbound.a"
+    DYNLIBMOD_EXTRALIBS="-Wl,--export-all-symbols,--out-implib,libunbound.dll.a"
   fi
 
 fi
diff --git a/configure.ac b/configure.ac
index 02b9eb47b..3e872bca9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -644,7 +644,7 @@ if test x_$withval != x_no; then
   if test $on_mingw = "no"; then
     DYNLIBMOD_EXTRALIBS="-ldl -export-dynamic"
   else
-    DYNLIBMOD_EXTRALIBS="-Wl,--export-all-symbols,--out-implib,libunbound.a"
+    DYNLIBMOD_EXTRALIBS="-Wl,--export-all-symbols,--out-implib,libunbound.dll.a"
   fi
   AC_SUBST(DYNLIBMOD_EXTRALIBS)
 fi
diff --git a/doc/Changelog b/doc/Changelog
index c3223b05a..335ecf89b 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+14 January 2021: Wouter
+	- Fix for #93: dynlibmodule import library is named libunbound.dll.a.
+
 13 January 2021: Wouter
 	- Merge #399 from xiangbao227: The lock of lruhash table should
 	  unlocked after markdel entry.
diff --git a/dynlibmod/examples/helloworld.c b/dynlibmod/examples/helloworld.c
index 7da32d9bb..be2116843 100644
--- a/dynlibmod/examples/helloworld.c
+++ b/dynlibmod/examples/helloworld.c
@@ -7,8 +7,10 @@
  * And to build for windows, first make unbound with the --with-dynlibmod
  * switch, then use this command:
  *   x86_64-w64-mingw32-gcc -m64 -I../.. -shared -Wall -Werror -fpic
- *      -o helloworld.dll helloworld.c -L../.. -l:libunbound.a
- * to cross-compile a 64-bit Windows DLL.
+ *      -o helloworld.dll helloworld.c -L../.. -l:libunbound.dll.a
+ * to cross-compile a 64-bit Windows DLL.  The libunbound.dll.a is produced
+ * by the compile step that makes unbound.exe and allows the dynlib dll to
+ * access definitions in unbound.exe.
  */
 
 #include "../../config.h"

From 285a7fdd2151672ba3d60914848c2113d4ed9d15 Mon Sep 17 00:00:00 2001
From: Florian Obser <florian@narrans.de>
Date: Thu, 14 Jan 2021 19:15:30 +0100
Subject: [PATCH 41/44] Implement IPv4-Embedded addresses according to RFC6052.

The original algorithm assumed that any prefix length would be valid
and did not skip over bits 64 to 71 and set them to zero.
This means that only dns64 prefixes with length 32 and 96 generated
embedded addresses according to RFC6052, cf. Figure 1 in 2.2.
---
 dns64/dns64.c | 40 ++++++++++++++++++++++------------------
 1 file changed, 22 insertions(+), 18 deletions(-)

diff --git a/dns64/dns64.c b/dns64/dns64.c
index 5c70119a5..e7552bb7d 100644
--- a/dns64/dns64.c
+++ b/dns64/dns64.c
@@ -198,14 +198,17 @@ uitoa(unsigned n, char* s)
 static uint32_t
 extract_ipv4(const uint8_t ipv6[], size_t ipv6_len, const int offset)
 {
-    uint32_t ipv4;
+    uint32_t ipv4 = 0;
+    int i, pos;
     log_assert(ipv6_len == 16); (void)ipv6_len;
-    ipv4 = (uint32_t)ipv6[offset/8+0] << (24 + (offset%8))
-         | (uint32_t)ipv6[offset/8+1] << (16 + (offset%8))
-         | (uint32_t)ipv6[offset/8+2] << ( 8 + (offset%8))
-         | (uint32_t)ipv6[offset/8+3] << ( 0 + (offset%8));
-    if (offset/8+4 < 16)
-        ipv4 |= (uint32_t)ipv6[offset/8+4] >> (8 - offset%8);
+    log_assert(offset == 32 || offset == 40 || offset == 48 || offset == 56 ||
+        offset == 64 || offset == 96);
+    for(i = 0, pos = offset / 8; i < 4; i++, pos++) {
+        if (pos == 8)
+            pos++;
+        ipv4 = ipv4 << 8;
+        ipv4 |= ipv6[pos];
+    }
     return ipv4;
 }
 
@@ -297,17 +300,16 @@ synthesize_aaaa(const uint8_t prefix_addr[], size_t prefix_addr_len,
 	size_t aaaa_len)
 {
     log_assert(prefix_addr_len == 16 && a_len == 4 && aaaa_len == 16);
+    log_assert(prefix_net == 32 || prefix_net == 40 || prefix_net == 48 ||
+        prefix_net == 56 || prefix_net == 64 || prefix_net == 96);
+    int i, pos;
     (void)prefix_addr_len; (void)a_len; (void)aaaa_len;
     memcpy(aaaa, prefix_addr, 16);
-    aaaa[prefix_net/8+0] |= a[0] >> (0+prefix_net%8);
-    aaaa[prefix_net/8+1] |= a[0] << (8-prefix_net%8);
-    aaaa[prefix_net/8+1] |= a[1] >> (0+prefix_net%8);
-    aaaa[prefix_net/8+2] |= a[1] << (8-prefix_net%8);
-    aaaa[prefix_net/8+2] |= a[2] >> (0+prefix_net%8);
-    aaaa[prefix_net/8+3] |= a[2] << (8-prefix_net%8);
-    aaaa[prefix_net/8+3] |= a[3] >> (0+prefix_net%8);
-    if (prefix_net/8+4 < 16)  /* <-- my beautiful symmetry is destroyed! */
-    aaaa[prefix_net/8+4] |= a[3] << (8-prefix_net%8);
+    for(i = 0, pos = prefix_net / 8; i < a_len; i++, pos++) {
+        if(pos == 8)
+            aaaa[pos++] = 0;
+        aaaa[pos] = a[i];
+    }
 }
 
 
@@ -374,8 +376,10 @@ dns64_apply_cfg(struct dns64_env* dns64_env, struct config_file* cfg)
         log_err("dns64_prefix is not IPv6: %s", cfg->dns64_prefix);
         return 0;
     }
-    if (dns64_env->prefix_net < 0 || dns64_env->prefix_net > 96) {
-        log_err("dns64-prefix length it not between 0 and 96: %s",
+    if (dns64_env->prefix_net != 32 && dns64_env->prefix_net != 40 &&
+            dns64_env->prefix_net != 48 && dns64_env->prefix_net != 56 &&
+            dns64_env->prefix_net != 64 && dns64_env->prefix_net != 96 ) {
+        log_err("dns64-prefix length it not 32, 40, 48, 56, 64 or 96: %s",
                 cfg->dns64_prefix);
         return 0;
     }

From e55f38fa83f5d43f202ca489cc72078adeeb694f Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Fri, 15 Jan 2021 08:15:54 +0100
Subject: [PATCH 42/44] Changelog entry for #402. - Merge #402 from fobser:
 Implement IPv4-Embedded addresses according   to RFC6052.

---
 doc/Changelog | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/doc/Changelog b/doc/Changelog
index 335ecf89b..2edaa330d 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+15 January 2021: Wouter
+	- Merge #402 from fobser: Implement IPv4-Embedded addresses according
+	  to RFC6052.
+
 14 January 2021: Wouter
 	- Fix for #93: dynlibmodule import library is named libunbound.dll.a.
 

From c125fe67bc42ec732ad53a3d2f095d656c9a03f4 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Mon, 18 Jan 2021 08:29:52 +0100
Subject: [PATCH 43/44] - Fix #404: DNS query with small edns bufsize fail.

---
 doc/Changelog         | 3 +++
 doc/example.conf.in   | 2 +-
 doc/unbound.conf.5.in | 5 ++---
 util/config_file.c    | 3 ++-
 4 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/doc/Changelog b/doc/Changelog
index 2edaa330d..27e8621c3 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+18 January 2021: Wouter
+	- Fix #404: DNS query with small edns bufsize fail.
+
 15 January 2021: Wouter
 	- Merge #402 from fobser: Implement IPv4-Embedded addresses according
 	  to RFC6052.
diff --git a/doc/example.conf.in b/doc/example.conf.in
index b51bcfca5..c1c3eb9b3 100644
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -388,7 +388,7 @@ server:
 	# target-fetch-policy: "3 2 1 0 0"
 
 	# Harden against very small EDNS buffer sizes.
-	# harden-short-bufsize: no
+	# harden-short-bufsize: yes
 
 	# Harden against unseemly large queries.
 	# harden-large-queries: no
diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index e7964d969..2fa8e7a95 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -839,9 +839,8 @@ closer to that of BIND 9, while setting "\-1 \-1 \-1 \-1 \-1" gives behaviour
 rumoured to be closer to that of BIND 8.
 .TP
 .B harden\-short\-bufsize: \fI<yes or no>
-Very small EDNS buffer sizes from queries are ignored. Default is off, since
-it is legal protocol wise to send these, and unbound tries to give very
-small answers to these queries, where possible.
+Very small EDNS buffer sizes from queries are ignored. Default is on, as
+described in the standard.
 .TP
 .B harden\-large\-queries: \fI<yes or no>
 Very large queries are ignored. Default is off, since it is legal protocol
diff --git a/util/config_file.c b/util/config_file.c
index 4c827b74e..a845dde23 100644
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -220,7 +220,7 @@ config_create(void)
 	cfg->views = NULL;
 	cfg->acls = NULL;
 	cfg->tcp_connection_limits = NULL;
-	cfg->harden_short_bufsize = 0;
+	cfg->harden_short_bufsize = 1;
 	cfg->harden_large_queries = 0;
 	cfg->harden_glue = 1;
 	cfg->harden_dnssec_stripped = 1;
@@ -388,6 +388,7 @@ struct config_file* config_create_forlib(void)
 	cfg->val_log_level = 2; /* to fill why_bogus with */
 	cfg->val_log_squelch = 1;
 	cfg->minimal_responses = 0;
+	cfg->harden_short_bufsize = 1;
 	return cfg;
 }
 

From f273716b8045e2b4f91306966582adafabb4f3f0 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Mon, 18 Jan 2021 10:23:01 +0100
Subject: [PATCH 44/44] - Fix declaration before statement and signed
 comparison warning in   dns64.

---
 dns64/dns64.c | 3 ++-
 doc/Changelog | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/dns64/dns64.c b/dns64/dns64.c
index e7552bb7d..0a40fd49e 100644
--- a/dns64/dns64.c
+++ b/dns64/dns64.c
@@ -299,10 +299,11 @@ synthesize_aaaa(const uint8_t prefix_addr[], size_t prefix_addr_len,
 	int prefix_net, const uint8_t a[], size_t a_len, uint8_t aaaa[],
 	size_t aaaa_len)
 {
+    size_t i;
+    int pos;
     log_assert(prefix_addr_len == 16 && a_len == 4 && aaaa_len == 16);
     log_assert(prefix_net == 32 || prefix_net == 40 || prefix_net == 48 ||
         prefix_net == 56 || prefix_net == 64 || prefix_net == 96);
-    int i, pos;
     (void)prefix_addr_len; (void)a_len; (void)aaaa_len;
     memcpy(aaaa, prefix_addr, 16);
     for(i = 0, pos = prefix_net / 8; i < a_len; i++, pos++) {
diff --git a/doc/Changelog b/doc/Changelog
index 27e8621c3..f50f294af 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,5 +1,7 @@
 18 January 2021: Wouter
 	- Fix #404: DNS query with small edns bufsize fail.
+	- Fix declaration before statement and signed comparison warning in
+	  dns64.
 
 15 January 2021: Wouter
 	- Merge #402 from fobser: Implement IPv4-Embedded addresses according